Proxy Server Intercepts Cloud API Calls to Block Unsanctioned Accounts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing services face data exfiltration threats due to unsanctioned user accounts accessing and sharing sensitive data, as existing security measures fail to effectively differentiate between sanctioned and unsanctioned accounts.
Innovation Solution
A network security system with a proxy server intercepts and inspects communications between cloud computing services and tenants, using tenant-defined policies and access key information to determine account permissions, blocking unsanctioned accounts from accessing sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security measures are used to access cloud computing services, then users can access cloud services conveniently, but data exfiltration cannot be effectively prevented because existing measures fail to differentiate between sanctioned and unsanctioned accounts
Solution Approach 1:
The patent introduces a proxy server as an intermediary component between users and cloud computing services. This proxy server intercepts API calls, extracts access key information, and communicates with the cloud service provider's API to verify account sanctions status. The intermediary enables security enforcement without requiring changes to the cloud service infrastructure or user workflows.
Solution Approach 2:
The system performs preliminary verification of account sanctions status before allowing access to cloud computing services. By checking the sanctions list in advance through API calls to the cloud service provider and blocking unsanctioned accounts before they can exfiltrate data, the system prevents security breaches proactively rather than reacting after incidents occur.
2Reliability
If access key information is intercepted and inspected to enforce policies, then data exfiltration can be prevented, but additional inspection and processing steps increase system complexity
Solution Approach 1:
The system leverages the cloud service provider's existing API infrastructure to perform verification of account sanctions status. Instead of building a complex independent verification system, the proxy server uses the cloud provider's own API endpoints to check account status, extracting access key information from intercepted traffic and submitting verification requests through the provider's established interfaces.
Solution Approach 2:
The system implements a feedback loop where the proxy server intercepts API calls, extracts access key information, queries the cloud service provider's API to determine sanctions status, and based on the feedback response, either allows or blocks the API call. This closed-loop feedback mechanism enables automated security enforcement with clear decision logic.
3Reliability
If tenant-defined policies are enforced through API interception, then unauthorized access can be blocked, but processing time increases due to additional inspection steps
Solution Approach 1:
The system performs partial verification by checking only the essential sanctions status through API calls to the cloud service provider, rather than conducting comprehensive security audits of all account activities. This selective verification approach enforces tenant-defined policies with sufficient accuracy while minimizing the time overhead of additional inspection steps.
Data Source
AI summary
The invention provides a method, apparatus and system for preventing exfiltration of data caused by use of an unsanctioned CCS account. The invention intercepts a communication including a request for access to data, where the communication is being transmitted between a user of the CCS, and a CCS host website, referred to as a CCS endpoint. The intercepted communication is inspected for information that is processed to obtain a CCS account identifier associated with a CCS account being used by a user of that CCS account. The CCS account identifier is further processed to access tenant defined policy information associated with the CCS account. The invention further performs actions to determine if the CCS account associated with the account identifier is unsanctioned (unpermitted) with respect to access to the particular data for which access is being requested by the user of that CCS account.