Cloud Operator Access Suspension for Customer Infrastructure Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud computing environments lack effective mechanisms to control and restrict access of cloud service provider (CSP) operators to customer cloud infrastructure environments, necessitating improved security and management of operator actions.

Innovation Solution

Implementing a system that enables customers to disable, terminate, or revoke operator access to resources within their cloud environment through a bastion service and permissions management, allowing selective control over CSP operator sessions and credentials.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If CSP operators have unrestricted access to customer cloud environments to perform maintenance and support actions, then operational efficiency and support capability are improved, but security risk and compliance vulnerability increase

Engineering Contradiction:

Improveoperational efficiencyVSAvoidsecurity risk

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system dynamically adjusts operator access permissions based on customer-defined policies. Access rights are not static but can be modified in real-time through policy updates, allowing the system to balance operational needs with security requirements adaptively

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

A policy management service acts as an intermediary between CSP operators and customer cloud environments. This intermediary enforces access control policies, allowing operators to perform necessary actions only when authorized by customer-defined policies, thus mediating between operational efficiency and security concerns

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If CSP operators can access customer cloud environments for deeper technical support, then technical issue resolution capability is improved, but access control complexity and compliance burden increase

Engineering Contradiction:

Improvetechnical issue resolution capabilityVSAvoidaccess control complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The policy management service provides a universal access control framework that handles multiple operator types (L1 support, L2 support, CSP operators) and various technical scenarios through a single unified system, reducing overall access control complexity while maintaining versatile technical support capabilities

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system segments operator access into different levels (L1, L2, and CSP operators) with progressively deeper technical capabilities. Each segment has defined policy constraints, allowing granular control over technical issue resolution while managing complexity through structured segmentation

Inventive Principle:

Principle #1Segmentation

3Object-affected harmful factors

If operator access to customer cloud environments is restricted to enhance security, then security risk is reduced, but operational capability and support effectiveness deteriorate

Engineering Contradiction:

Improvesecurity riskVSAvoidoperational capability

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The system implements feedback mechanisms where access decisions are continuously evaluated against customer-defined policies. The policy management service monitors operator actions and enforces policy constraints in real-time, providing feedback that ensures security requirements are met while operational capabilities are maintained within authorized boundaries

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system changes access parameters dynamically based on policy conditions. Instead of fixed restricted access, the system adjusts permission parameters in real-time according to customer-defined policy criteria, allowing operational capability to flourish when policies permit while maintaining security when policies restrict

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12615145B2Controlling operator access to customer cloud infrastructure environments

Publication Date: 2026.04.28 ORACLE INT CORP

AI summary

Techniques for enabling a customer operator of a cloud service provider (CSP) the ability to disable operator access to resources in a customer cloud environment are disclosed. Operator access may be disabled or suspended by operators of the CSP customer initiating a disable command. Disabling operator access includes (a) terminating existing sessions that provide operators access to the resources, (b) rejecting new requests for credentials to establish sessions that provide operator access, and/or (c) revoking existing credentials used to establish sessions that provide operator access. Disabling operator access may apply to resources in the customer cloud environment or to a subset of resources and/or may apply to some operators but not to other operators. The operators may be of the same or different categories of operators. At the conclusion of a designated period of time, the ability of operator to access the customer cloud environment may be restored.