Hybrid Access Control for Cloud Hierarchies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing RBAC-based access control techniques in cloud-services computing environments struggle to efficiently adjust access control settings due to propagation issues, leading to undesired access privileges for users across hierarchical systems, particularly between tenant and service provider domains.
Innovation Solution
The hybrid access control technique adjusts role-based access settings by determining user group memberships and propagating access control settings only within appropriate domains, allowing for flexible adjustments without requiring a complete redesign of the RBAC model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Stability of the object's composition
If role-based access control settings are propagated from parent sub-system to child sub-system in a hierarchical system, then access control consistency is maintained across the hierarchy, but the ability to restrict access in specific sub-systems (e.g., service provider files) is lost
Solution Approach 1:
The patent segments the access control system into two distinct components: inheritance-based access control for general hierarchical consistency and rule-based access control for specific sub-system restrictions. This segmentation allows the system to maintain access control consistency through propagation while simultaneously enabling flexible restrictions in specific sub-systems through independently configurable rules.
Solution Approach 2:
The patent applies local quality by allowing different access control mechanisms to operate at different levels of the hierarchy. Parent sub-systems use propagated role-based access control settings for consistency, while child sub-systems can have localized rule-based access control rules that override or supplement the propagated settings, enabling site-specific or resource-specific access restrictions.
2Adaptability or versatility
If access control settings are adjusted for specific users in child sub-systems, then flexible access control is achieved, but system complexity increases due to manual configuration requirements
Solution Approach 1:
The patent implements a unified hybrid access control system that combines both inheritance-based and rule-based mechanisms into a single framework. This universal system can handle both automatic propagation scenarios and manual restriction scenarios through a common interface and evaluation process, reducing the need for separate configuration systems and lowering overall system complexity.
Solution Approach 2:
The patent incorporates feedback mechanisms where the access control system continuously evaluates both propagated role-based settings and locally defined rule-based settings. This feedback loop automatically reconciles potential conflicts between inherited and localized rules, reducing manual configuration complexity by providing automated conflict resolution while maintaining access control flexibility.
Data Source
AI summary
Techniques for providing hybrid access control in a cloud-services computing environment are provided. In one embodiment, a method for providing hybrid access control is provided at a host computing device. The method includes obtaining access control settings including at least a first user's role-based access settings with respect to a first sub-system of a hierarchical computing-resource system. The method further includes propagating the access control settings from the first sub-system to a second sub-system; obtaining user group domains assigned to a plurality of sub-systems; and obtaining a group membership associated with the first user. The method further includes determining, based on the obtained user group domains and the obtained group membership associated with the first user, whether the first user's role-based access settings propagated to the second sub-system are to be adjusted; and making adjustments accordingly.