Hybrid-Cloud Privilege Assignment for Secure Service Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hybrid-cloud stacks face security risks due to siloed and duplicated identities leading to high-privileged accounts, which are often pre-defined and can result in unauthorized access and security breaches.
Innovation Solution
A security system that dynamically assigns privilege levels by retrieving mappings and authority structures, escalating privileges when necessary, and managing permissions across multiple cloud environments to ensure secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If pre-defined high-privileged service accounts are used to ensure components can call each other, then service communication is enabled, but security risks increase if the account is leaked
Solution Approach 1:
The patent implements dynamic privilege escalation where service accounts start with minimal privileges and temporarily escalate to higher privileges only when needed for specific operations. This dynamic approach replaces static high-privileged accounts, enabling service communication while minimizing security exposure by limiting privilege duration and scope.
Solution Approach 2:
The system assigns different privilege levels to different services and operations rather than using a single high-privileged account for all operations. Each service receives the minimum necessary privileges for its specific function, creating localized privilege assignments that reduce overall security risk while maintaining operational capability.
2Ease of operation
If users are granted highest permissions for their role to enable authorized operations, then user authorization is simplified, but security risks increase as users may access operations they do not need
Solution Approach 1:
The patent implements dynamic privilege escalation for users, where privilege levels are adjusted in real-time based on the specific operation being performed. Users start with base role privileges and temporarily escalate only when required for specific tasks, then automatically de-escalate. This maintains operational simplicity while preventing unauthorized access to operations beyond what is immediately needed.
3Reliability
If IAM solutions with pre-defined access policies are deployed, then authorization management is established, but flexibility is reduced due to mostly pre-defined policies
Solution Approach 1:
The system replaces static pre-defined policies with dynamic privilege escalation mechanisms that automatically adjust access rights based on real-time operational context. This enables the authorization system to adapt to diverse scenarios while maintaining reliable control through automated escalation and de-escalation protocols.
Solution Approach 2:
The patent changes the parameters of access policies from fixed, pre-defined values to dynamic, context-dependent values. Privilege levels become adjustable parameters that change based on operational requirements, service identities, and security context, enabling flexible authorization while maintaining systematic control.
Data Source
AI summary
Security with dynamic privilege level assignment in a hybrid-cloud stack is provided. A request associated with a user is received. For the request, a mapping and an authority structure are retrieved, where the mapping identifies a plurality of services and the authority structure identifies requisite privilege levels of the plurality of services. For the user, an allowed privilege range is retrieved. A current privilege level is set to a minimum privilege level of the allowed privilege range. A requisite privilege level for the request is determined based on the requisite privilege levels of the plurality of services. In response to determining that the current privilege level is less than the requisite privilege level for the request, the current privilege level is escalated based on the allowed privilege range and the requisite privilege level for the request, and the request is processed using the escalated privilege level.