Distributed Ledger Cloud Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current cloud computing systems lack robust and secure mechanisms for managing access rights to cloud services, particularly in scenarios involving third-party agents, where ensuring immutability and cryptographic protection of transaction records is essential for preventing unauthorized access and reversing transactions.

Innovation Solution

Implementing a cryptographically-protected distributed ledger, such as a blockchain, integrated with an Identity and Access Management (IAM) service and a distributed ledger proxy service to record and enforce access rights assignments, ensuring immutability and cryptographic protection of transaction records, and providing an interface for managing access rights through a cloud infrastructure.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional access control mechanisms are used in cloud computing systems, then ease of operation is maintained, but security and reliability are insufficient to prevent unauthorized access and transaction reversal

Engineering Contradiction:

Improvesecurity of access controlVSAvoidcomplexity of access control system

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a distributed ledger as an intermediary layer between identity and access management services. This mediator records access control transactions immutably, providing cryptographic proof of authorization without requiring complex trust relationships between cloud service providers and third-party agents. The distributed ledger acts as a neutral arbiter that enhances security while maintaining operational simplicity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces traditional mechanical access control mechanisms (based on trust and manual verification) with cryptographic mechanisms. Digital signatures, hash functions, and other cryptographic primitives substitute for manual authorization processes, providing automated, tamper-proof verification of access rights that is both more secure and easier to operate.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Productivity

If access rights are assigned to third-party agents, then productivity is improved, but risk of unauthorized access increases

Engineering Contradiction:

Improveefficiency of cloud service accessVSAvoidunauthorized access risk

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The distributed ledger provides continuous feedback about the state of access rights through immutable transaction records. Every access control decision is recorded and can be audited, creating a feedback loop that allows system operators to monitor and verify that third-party agents are operating within their authorized boundaries, thereby reducing unauthorized access risk while maintaining productivity.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system performs preliminary cryptographic verification of access rights before granting cloud service access. By pre-establishing digital signatures and authorization proofs in the distributed ledger, the system ensures that only legitimately authorized third-party agents can access cloud resources, preventing unauthorized access before it can occur while enabling efficient productivity-enhancing delegation.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If transaction records are made immutable through cryptographic protection, then reliability is improved, but ease of repair and modification becomes difficult

Engineering Contradiction:

Improveimmutability of transaction recordsVSAvoidability to modify access control records

Core Design Contradiction:

ReliabilityVSEase of repair

Solution Approach 1:

The patent segments the access control system into immutable transaction records and mutable policy definitions. The distributed ledger stores immutable records of access decisions, while access policies themselves can be modified through new transactions. This segmentation allows the system to maintain reliability through immutability of past decisions while enabling flexibility through the ability to create new authorization rules when needed.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS11855987B1Utilizing distributed ledger for cloud service access control

Publication Date: 2023.12.26 AMAZON TECH INC

AI summary

A method of utilizing a distributed ledger for a cloud service access control. The method may include receiving, by an identity and access management (IAM) service, an identifier of a client of a cryptographically protected distributed ledger; transmitting, to a proxy service, a subscription request for distributed ledger transactions initiated by the client; receiving, from the proxy service, a transaction notification comprising an identifier of the client, an identifier of an autonomous agent, and an identifier of a cloud service; receiving, from the cloud service, a validation request with respect to an action request submitted by the autonomous agent; validating, using the transaction notification, the action request; and notifying the cloud service of validity of the action request.