PaaS Instance Space Access Control for Cross-Pool Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional Platform as a Service (PaaS) implementations face security breaches due to the lack of appropriate access controls, particularly with cross-pool replication features, which can lead to unauthorized access and data inconsistencies.

Innovation Solution

Implementing a method that intercepts user requests for creating service instances, generates instance spaces, assigns access criteria, and connects applications, while applying these criteria to determine access permissions, ensuring secure access and replication between service instances across different pools.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If cross-pool replication feature is enabled to allow services from one pool to be accessible to users in other pools, then service accessibility and replication capability are improved, but security breaches and unauthorized access risks increase

Engineering Contradiction:

Improveservice accessibilityVSAvoidsecurity breaches

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an instance space as an intermediary layer between service instances in different pools. This instance space acts as a mediator that controls and manages cross-pool access, allowing services to be replicated and accessed across pools while maintaining security through controlled entry points and access policies.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the cross-pool access control into multiple criteria including IP address matching, identity verification, and organization validation. By dividing the access control mechanism into distinct segmentation layers, the system can evaluate multiple security dimensions independently to prevent unauthorized access while allowing legitimate cross-pool service replication.

Inventive Principle:

Principle #1Segmentation

2Reliability

If access controls are implemented for cross-pool replication, then security is improved, but system complexity and access control overhead increase

Engineering Contradiction:

ImprovesecurityVSAvoidaccess control system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements preliminary action by pre-configuring instance spaces with access control criteria before cross-pool replication occurs. The system pre-establishes IP address ranges, identity credentials, and organization permissions in advance, so that when replication requests occur, the access control decisions can be made efficiently based on pre-evaluated criteria rather than complex real-time computations.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The instance space serves multiple functions simultaneously: it acts as a container for service instances, a security boundary for access control, and a replication management point. This multi-functionality reduces overall system complexity by consolidating multiple control mechanisms into a single universal structure that handles both security and replication tasks.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Measurement precision

If multiple access criteria are applied to determine whether to allow access, then access control precision is improved, but processing time and request handling overhead increase

Engineering Contradiction:

Improveaccess control precisionVSAvoidrequest processing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent implements partial action by evaluating access control criteria in a staged manner. The system first performs quick preliminary checks on basic criteria such as IP address ranges and organization identifiers before proceeding to more complex identity verification only when necessary. This partial evaluation approach maintains high precision by checking all criteria ultimately, while reducing average processing time by skipping detailed verification for requests that fail initial filters.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11736485B2Method and system for providing platform as a service with security access controls

Publication Date: 2023.08.22 JPMORGAN CHASE BANK NA

AI summary

A method and a system for facilitating access control with respect to an application in a cloud computing environment are provided. The method includes: intercepting a first request from a user for creating a service instance for a first application; generating an instance space for the service instance in a pool within the cloud computing environment; assigning criteria for determining whether to allow access to the service instance via the instance space; facilitating a creation of the service instance; and connecting the first application to the service instance. When a second request for accessing the service instance via the instance space is received from a subsequent requester, the criteria are applied to the received second request in order to determine whether to allow the requested access.