Multi-Tenant Management Identity Architecture for Breach Containment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant computing systems, maintaining security in the management plane is challenging, as a compromised portion can lead to surreptitious access to customer data, and existing security architectures are inadequate to prevent widespread breaches.
Innovation Solution
The system employs management identities with segmented access, storing authentication credentials in non-exportable key vaults within subscriptions, using short-lived, least privileged access credentials, and authorizing operations through manual authorization systems, with external access limited to private links, thereby isolating potential breaches to a single subscription.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If centralized credential storage is used across all subscriptions, then ease of management is improved, but security is worsened as a compromise affects all subscriptions
Solution Approach 1:
The patent implements segmentation by creating separate key vaults for each subscription, isolating credentials within individual subscription boundaries. This allows the management plane to maintain centralized control architecture while preventing credential compromise from propagating across multiple subscriptions, thus resolving the contradiction between ease of management and security.
2Ease of operation
If management credentials are stored externally for ease of access, then ease of operation is improved, but security is worsened due to increased exposure risk
Solution Approach 1:
The patent introduces key vaults as intermediary components between the management applications and the credential storage. These key vaults act as secure mediators that provide controlled access to credentials within each subscription, eliminating the need for external credential storage while maintaining ease of access through standardized key vault interfaces.
3Ease of operation
If long-lived credentials are used for management operations, then ease of operation is improved, but security is worsened due to extended attack window
Solution Approach 1:
The patent implements periodic credential rotation by configuring key vaults to automatically rotate management credentials at defined intervals. This periodic action ensures that even if credentials are compromised, the attack window is limited to the rotation period, while maintaining ease of operation through automated credential management without manual intervention.
Data Source
AI summary
In a multi-tenant computing system, a set of subscriptions are generated, to which resources are assigned. Each subscription has a management application that is used to manage access to resources in the subscription. Credentials that are used by the management application are stored in a key vault within the subscription.