Resource-Ownership Policy Manager for Distributed Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional access management systems in distributed computing environments lack efficient mechanisms for resource policy management, leading to errors in policy application due to incorrect ownership and frequent changes in resource ownership, resulting in increased workload and security risks.
Innovation Solution
Implementing a resource-ownership policy manager with a self-service engine and runtime policy evaluation engine that applies policies exclusively to resource instances owned by their respective owners, preventing incorrect policy applications and streamlining policy management through user interfaces and diagnosis operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional access management systems apply policies to all resource instances without ownership verification, then policy application coverage is improved, but policy application accuracy deteriorates due to incorrect ownership matching
Solution Approach 1:
The system performs preliminary ownership verification before applying policies to resource instances. The policy manager evaluates whether the policy owner matches the resource owner in advance, preventing incorrect policy applications. This preliminary check ensures that only appropriately owned policies are applied to each resource instance, thereby improving policy application accuracy without requiring complex post-application corrections.
2Reliability
If manual policy management is implemented for each resource instance, then policy application accuracy is improved, but workload increases significantly
Solution Approach 1:
The policy manager automatically performs ownership verification and policy application without requiring manual intervention for each resource instance. The system self-evaluates policy-owner-to-resource-owner matching and autonomously applies or rejects policies based on ownership criteria. This automation maintains high policy application accuracy while eliminating the need for manual policy management for each resource, thereby improving overall management efficiency.
3Reliability
If resource ownership verification is implemented before policy application, then policy application accuracy is improved, but processing time increases
Solution Approach 1:
The system performs ownership verification as a preliminary, automated step that occurs rapidly before policy application. By establishing ownership matching criteria in advance and using automated evaluation, the verification process is completed quickly without significant delay. This approach ensures accurate policy application to the correct resource instances while minimizing the time loss associated with ownership checking.
Data Source
AI summary
Methods, systems, and computer storage media for providing access to computing environments are provided. Based on a resource-ownership policy manager (i.e., a self-service engine and a runtime policy evaluation engine) that provides resource-ownership policy operations executed to apply a resource owner's policies only on resource owned by the resource owner. In operation, at runtime, a first resource instance is identified and an entity is determined to be the resource owner of the first policy and first resource instance. The first policy is applied to the first resource instance because the entity owns both the first policy and the first resource instance. A second resource instance is identified and the entity is determined not to be the resource owner of the second resource instance. A second resource policy of the entity is not applied to the second resource instance because the entity is not the owner of the second resource instance.