Network Traffic Context Estimation for Access Control Recertification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In migration scenarios from monolithic to service architectures or in cloud environments, collecting context information for access control recertification is challenging due to the mix of modules and micro-services, especially in multi-cloud setups where no single provider collects log information, making correlation difficult.
Innovation Solution
Estimate context information from network traffic using a machine learning engine during the migration process, collecting training sets from both log and network traffic information to refine the estimation engine incrementally.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If log information collection is used in multi-cloud environments with micro-services, then context information for recertification can be obtained, but the complexity of collecting and correlating logs from multiple cloud providers increases significantly
Solution Approach 1:
The patent introduces a network traffic analysis system as an intermediary that observes and analyzes network traffic between subjects and objects across multiple cloud providers. This intermediary approach allows context information to be collected without requiring direct access to or correlation of internal logs from multiple cloud providers, thereby reducing complexity while maintaining information availability.
2Ease of operation
If network traffic analysis is used to estimate context information, then recertification can be performed without accessing external log information, but the precision of context information estimation may be reduced
Solution Approach 1:
The patent replaces the mechanical/log-based information collection system with a network traffic analysis system. Instead of directly extracting context information from application logs (mechanical approach), the system uses network traffic patterns, metadata, and behavioral analysis to infer context information, achieving operational simplicity while maintaining sufficient accuracy for recertification purposes.
3Loss of information
If a machine learning estimation engine is deployed to analyze network traffic, then context information can be obtained in service architectures, but the computational resources and system complexity increase
Solution Approach 1:
The machine learning estimation engine is designed to autonomously analyze network traffic patterns and self-adjust to different service architectures without requiring manual configuration or complex integration with underlying infrastructure. The engine independently performs context information extraction, reducing the burden on external systems while recovering essential context information.
Data Source
AI summary
The present disclosure relates to facilitating a recertification of access control information. A corresponding method comprises collecting network traffic information relating to a network. Context information is estimated from the network traffic information for accesses to the software application relating to invocations over the network of services contributing (at least in part) to implement the software application. For example, the context information is estimated by an estimation engine that is configured incrementally during a migration of the software application from a module architecture to a service architecture (according to the network traffic information and to corresponding log information). A computer program and a computer program product for performing the method are also proposed. Moreover, a system for implementing the method is proposed.