Multi-Cloud Identity Provisioning for Cross-Provider Service Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Customers of a cloud environment are restricted to using services offered by that cloud environment and lack seamless access to services provided by different cloud service providers, creating isolated ecosystems.
Innovation Solution
A multi-cloud control plane facilitates access to services by extracting identifiers, obtaining resource principal session tokens, and deploying resources based on allocated sets of resources across different cloud environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a customer subscribes to a cloud environment provided by a CSP, then the customer can use the services offered by that cloud environment, but the customer is restricted to using only those services and cannot access services offered by different cloud service providers
Solution Approach 1:
The patent introduces an identity service as an intermediary component that mediates between customers and multiple cloud service providers. This identity service enables cross-cloud authentication and authorization, allowing customers to access services across different cloud environments through a unified identity framework, thus resolving the restriction to single-cloud services while maintaining manageable system complexity
Solution Approach 2:
The patent implements a universal identity service that performs multiple functions including authentication, authorization, and resource provisioning across different cloud service providers. This multi-functional approach allows a single identity service to enable access to diverse cloud services without requiring separate authentication mechanisms for each provider, thereby improving versatility while controlling complexity
2Ease of operation
If cloud environments operate as closed ecosystems, then each cloud service provider can maintain control and security, but customers cannot seamlessly access services across different cloud providers
Solution Approach 1:
The identity service acts as a trusted intermediary that maintains security boundaries while enabling seamless access. It implements secure authentication and authorization mechanisms that verify customer identities and permissions before granting access to cloud services, thus allowing easy cross-cloud service access without compromising the security and reliability of individual cloud ecosystems
Solution Approach 2:
The system performs preliminary authentication and authorization actions through the identity service before customers access cloud services. By pre-validating identities and permissions, the system ensures secure access without requiring complex security checks during service operations, thereby improving ease of operation while maintaining reliability
Data Source
AI summary
A multi-cloud control plane of a source cloud environment receives from a control plane of a target cloud environment, a first request for accessing a service provided in the source cloud environment, the first request including a plurality of identifiers that enable identifying a first set of resources in the target cloud environment that are allocated to a customer. A first identifier is extracted from the plurality of identifiers included in the first request. Responsive to validating the first identifier, the multi-cloud control plane obtains a resource principal session token (RSPT), and information related to a second set of resources in the source cloud environment that are allocated to the customer. The multi-cloud control plane triggers the service provided in the source cloud environment based on the RSPT, wherein the service deploys service-based resources based on the second set of resources in the source cloud environment.