Ingress Control for Data Resource Creation on Cloud Platforms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based data processing platforms face challenges in ensuring robust and secure user management for creating and accessing data resources, particularly in multi-tenant environments where data isolation and fine-grained permission control are necessary.
Innovation Solution
The method involves receiving a user request to create a data resource, verifying the user's permissions using a predetermined set of permissions, and creating a version of the data resource with associated launch functions that manage access and secret information, ensuring secure deployment and execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple organizations store and execute data resources on the same platform, then platform utilization and resource sharing are improved, but data isolation and security are worsened
Solution Approach 1:
The patent segments the platform into isolated execution environments (containers) for each organization, allowing multiple organizations to share the same physical infrastructure while maintaining logical separation. Each organization's data resources run in their own isolated namespace, preventing cross-contamination while maximizing resource utilization.
Solution Approach 2:
The patent introduces an intermediary verification mechanism that mediates between multiple organizations accessing the shared platform. This intermediary layer verifies user permissions and enforces data isolation policies, allowing secure multi-tenant operation without requiring complete physical separation of resources.
2Ease of operation
If users are granted broad permissions to create and modify data resources, then ease of operation is improved, but security and unauthorized access are worsened
Solution Approach 1:
The patent performs preliminary verification of user permissions before allowing data resource creation or modification. The verification mechanism checks user credentials and authorization levels in advance, ensuring that only authenticated users with appropriate permissions can perform operations, thus maintaining security while enabling operational flexibility.
Solution Approach 2:
The patent implements dynamic permission verification that adapts to each user's specific authorization level and the particular operation being requested. Rather than static permission settings, the system dynamically evaluates user credentials against required permissions for each specific data resource operation, allowing fine-grained access control that maintains both security and operational ease.
Data Source
AI summary
A method of providing ingress control comprises managing one or more replicas of an application on a software platform; creating an annotation resource that includes one or more annotations for the software platform; creating an ingress resource for a specific annotation of the one or more annotations, the specific annotation being in a specification for the application; receiving a request to access the application from a device external to the software platform, the request matching the specific annotation; and routing the request to a replica of the one or more replicas based on the ingress resource.