Distributed Network Access With Ephemeral Credentials for Virtual Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network architectures face challenges in providing secure, real-time access to virtual resources while minimizing data processing latency and reducing the risk of persistent access by compromised compute instances.
Innovation Solution
A network architecture that separates logical access and network access into different compute instances, where the first compute instance generates ephemeral credentials for the second compute instance to perform actions on virtual resources, ensuring temporary and limited access, thereby enhancing security and reducing the risk of data exfiltration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single compute instance has both logical access and network access to virtual resources, then ease of operation is improved, but network security deteriorates due to persistent access risk
Solution Approach 1:
The patent segments the compute instance into two separate components: a first compute instance that holds logical permissions (credentials) and a second compute instance that has network access to the virtual resource. This segmentation ensures that no single instance has both persistent logical access and network access, thereby improving security while maintaining operational capability through coordinated interaction between the two instances.
2Reliability
If ephemeral credentials are used for access, then network security is improved, but device complexity increases due to multiple compute instances
Solution Approach 1:
The patent introduces an intermediary mechanism where the first compute instance acts as a credential manager that generates ephemeral credentials, and the second compute instance acts as an executor that uses these credentials temporarily. This intermediary arrangement with clearly defined roles simplifies the security model compared to a single complex instance, as each component has a specific, limited function.
3Reliability
If access controls are implemented on processing components, then network security is improved, but processing latency increases
Solution Approach 1:
The patent implements preliminary action by pre-establishing the separation of credentials and network access before any data processing occurs. The first compute instance generates credentials in advance, and the second compute instance is configured with network access paths beforehand. This preliminary setup eliminates the need for complex access control checks during actual data processing operations, thereby reducing processing latency while maintaining security.
Data Source
AI summary
Embodiments described herein can involve improved network security based on a distributed network access and logical permission architecture. In an example, a computer system can receive, by a first compute instance of the system from a user device, a request indicating an action to be performed on an element of a virtual resource. The first compute instance can be associated with a logical permission to use the virtual resource and may lack network access to the virtual resource. The first compute instance can cause a credential to be generated that enables the action to be performed on the element only and has an expiration attribute. The first compute instance can provide the credential to a second compute instance of the system which has network access to the virtual resource. The second compute instance can cause the action to be performed based on the credential and the network access.