Layered Cloud Authentication for Entity-Specific Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based resource access management systems lack the ability to integrate customer-specific authentication with cloud service provider authentication, leading to inconsistent and unmanaged permissions and privileges.
Innovation Solution
Implement a layered authentication method that combines first layer privileges from a cloud service provider or OEM authentication with second layer privileges from an entity-specific authentication module, determining access based on a combination of both sets of credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single authentication module is used for cloud resource access, then the access control is simple to implement, but the security and customization capabilities are insufficient
Solution Approach 1:
The authentication system is divided into multiple independent authentication modules, each responsible for different layers of verification. The first authentication module handles basic identity verification while the second authentication module handles entity-specific permission verification, allowing the system to achieve enhanced security through modular architecture
Solution Approach 2:
The authentication modules are nested in a hierarchical structure where the second authentication module operates within the context of the first authentication module's verification. The system evaluates credentials through multiple nested layers, with each layer building upon the previous one to provide comprehensive security
2Adaptability or versatility
If cloud service provider authentication is used alone, then the authentication process is straightforward, but customer-specific permission management is not possible
Solution Approach 1:
The authentication system is designed to serve multiple functions: the first authentication module provides universal cloud service provider authentication, while the second authentication module provides entity-specific customization. Both modules work together to provide a multi-functional authentication system that handles both standardized and customized permission requirements
3Adaptability or versatility
If multiple authentication modules are implemented, then security and customization are improved, but the authentication process becomes more complex
Solution Approach 1:
The system employs an intermediary evaluation mechanism that automatically coordinates between multiple authentication modules. The intermediary component synthesizes credentials from different modules and applies evaluation rules to determine access permissions, shielding users from the complexity of multiple authentication layers while maintaining security
Data Source
AI summary
A disclosed method for managing access to cloud infrastructure include responding to receiving a user request to access a cloud resource, such as a cluster associated with a hyper-converged infrastructure appliance, associated with an entity by performing a layered authentication of the user. The layered authentication includes determining first layer privileges based on first user credentials associated with a first authentication module and determining second layer privileges based on second user credentials associated with a second authentication module. The request is granted or denied based on a combination of the user's first and second layer privileges. The first authentication module may be associated with a first authentication domain such as an authentication domain of a cloud service provider or an OEM of cloud infrastructure resources. The second authentication module may comprise an authentication module maintained by the entity associated with the resource targeted by the user request.