Delegate Credential Issuance for IAM Identity Gaps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing networks face challenges in allowing computing entities without identities in the Identity Access Management (IAM) system to access target resources, despite having access policies associated with delegate principals.
Innovation Solution
The implementation of delegate credentials that allow a recipient principal to access target resources based on the access policies associated with a delegate principal, even if the recipient principal lacks an identity in the IAM system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a computing entity without an identity in the IAM system attempts to access target resources, then access control based on existing identities cannot be applied, but allowing access without identities compromises security
Solution Approach 1:
The patent introduces a delegate principal as an intermediary entity that has an identity in the IAM system with appropriate access policies. This delegate principal acts as a mediator between the computing entity without identity and the target resources. The delegate principal's credential is used to authenticate the computing entity, allowing it to access resources under the delegate principal's identity, thus maintaining security while enabling access for entities without direct IAM identities.
2Reliability
If access policies are strictly enforced for all principals, then security is maintained, but computing entities without identities are blocked from accessing resources they should be able to access
Solution Approach 1:
The delegate principal serves as a mediator that bridges the gap between security enforcement and access availability. The IAM system enforces access policies on the delegate principal's identity, not directly on the computing entity. This allows the system to maintain strict security controls while still enabling authorized access for computing entities without identities, as the delegate principal's policies govern the access.
Solution Approach 2:
The access control mechanism is segmented into two layers: the delegate principal layer (which has IAM identity and policies) and the computing entity layer (which uses the delegate credential). This segmentation allows the IAM system to enforce policies on the delegate principal while the computing entity can access resources through the delegated credential, separating the security enforcement point from the access request point.
3Adaptability or versatility
If delegate credentials are issued to allow access, then access flexibility is improved, but the complexity of the access control system increases
Solution Approach 1:
The delegate credential acts as a copy or representation of the delegate principal's identity and access rights. Instead of modifying the original IAM system or creating complex new authentication mechanisms, the system creates a credential that copies the essential access information from the delegate principal. This allows computing entities to access resources using this copied credential without significantly increasing system complexity.
Data Source
AI summary
A system provides a delegate credential to access a target resource based on one or more access policies associated with a delegate principal. The system receives a credential request for the delegate credential from a computing entity associated with a recipient principal. The system transmits an approval request to an approval service associated with the target resource for the approval service to approve issuance of the delegate credential to the recipient principal. The system receives an approval confirmation from the approval service and generates the delegate credential responsive to receiving the approval confirmation. The system transmits the delegate credential to a computing entity associated with the recipient principal. The computing entity accesses the target resource by presenting the delegate credential to a resource service associated with the target resource.