Identity-Aware Proxy for Cloud Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face challenges in improving security governance for legacy and new cloud applications without altering application logic, particularly in managing access control across multiple cloud resources and ensuring authorization for sensitive data access by internal and external users.
Innovation Solution
An identity-aware proxy is implemented at an edge router, which performs attribute-based access control by authenticating users and authorizing actions through an OpenID Connect (OIDC)-compliant identity provider, using JSON Web Tokens to manage access rights and relay traffic between client devices and resource servers, enabling centralized user access control without modifying application logic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cloud services are adopted to reduce infrastructure costs and complexity, then enterprises can access scalable and flexible cloud resources, but access control to multiple cloud services becomes more complicated and security governance becomes challenging
Solution Approach 1:
An identity-aware proxy is introduced as an intermediary component between client devices and cloud resources. The proxy intercepts requests, performs attribute-based access control evaluation, and manages authentication tokens. This mediator handles the complexity of access control centrally, allowing multiple cloud services to be accessed without increasing per-service control complexity.
Solution Approach 2:
The identity-aware proxy implements a universal access control mechanism that works across multiple different cloud services and resources. By using a standardized attribute-based access control model with JSON Web Tokens, the system provides multi-functional access control that can be applied to various cloud resources (storage, computing, applications) without requiring service-specific access control implementations.
2Reliability
If attribute-based access control is implemented at an identity-aware proxy, then centralized user access control and security governance are improved, but the system requires additional authentication and authorization components
Solution Approach 1:
The system performs preliminary authentication and authorization actions at the identity-aware proxy before requests reach cloud resources. User credentials are verified, attributes are evaluated against access control policies, and authentication tokens are issued in advance. This preliminary action ensures security governance is established before resource access, preventing unauthorized access attempts from reaching the cloud services.
Solution Approach 2:
The identity-aware proxy creates and manages digital representations of user identities and their attributes through JSON Web Tokens. Instead of directly evaluating user attributes against policies for each request, the system copies relevant authorization information into tokens that can be efficiently validated. This copying mechanism simplifies the authentication process while maintaining security governance reliability.
Data Source
AI summary
In one embodiment, a method by a first network apparatus includes receiving a request to access a resource from a client device associated with a user, determining that the request does not comprise a session cookie, sending an authorization request to a second network apparatus, receiving an authorization response including a resource authorization token from the second network apparatus, determining that the user is authorized to access the resource using the client device based on the received resource authorization token, establishing a first communication session with the client device by sending a message to the client device, and establishing a second communication session with a resource server that provides the resource, where the first network apparatus relays traffic between the client device and the resource server.