Facet Security Framework for Federated Cloud Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing policy-based authorization systems fail to function effectively in multi-domain federated authorization environments, leading to replication of subscriber databases and access controls, as they are designed for enterprise settings rather than the evolving multiple-party cloud scenarios with application mash-ups and resource compositions.
Innovation Solution
A security framework that intercepts action requests in a cloud environment, utilizing a trust authority module and trust enforcer module to manage facets, which are tokens or keys controlling access to resources, ensuring valid policies are applied across multiple domains through a federated architecture, including identity providers and data dictionaries to handle disparate standards.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing policy-based authorization systems are used in multi-domain federated environments, then enterprise authorization settings are maintained, but replication of subscriber databases and access controls occurs
Solution Approach 1:
The patent introduces a facet server as an intermediary component that mediates between identity providers and resource providers in federated environments. The facet server stores and manages facet data structures that encode authorization policies, acting as a central repository that eliminates the need for each domain to replicate subscriber databases. When authorization decisions are needed, the trust enforcer queries the facet server for relevant facet data, which is then used to make authorization decisions without requiring local database replication.
2Adaptability or versatility
If users are on-boarded from participating domains where resources exist, then domain-specific authorization is maintained, but access control replication occurs across domains
Solution Approach 1:
The patent creates a universal authorization framework where facets serve multiple domains and purposes simultaneously. A single facet data structure can be used across different domains to represent the same authorization policy, eliminating the need to replicate access control data in each domain. The facet server provides a universal interface for retrieving facet data that can be applied consistently across federated domains, reducing the quantity of access control data that would otherwise need to be replicated.
3Reliability
If facets are validated by evaluating policies, then access control security is improved, but processing time increases
Solution Approach 1:
The patent implements preliminary action by pre-computing and storing authorization policies in facet data structures before they are needed for actual authorization decisions. The facet server maintains these pre-evaluated policies, so when an authorization request occurs, the trust enforcer can quickly retrieve and apply pre-computed facet data without performing complex policy evaluations in real-time. This shifts the computational burden to an offline or background process, reducing the time loss during actual access control operations.
Data Source
AI summary
An example method is provided and includes intercepting an action request from an entity for an action to be performed with respect to a resource in a cloud environment, where the action request comprises a resource facet that controls access to the resource. The method also includes determining whether the resource facet is valid for the action by evaluating a policy associated with the resource; and allowing the action.