Role-Based Access Control for Cloud Protocol Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing systems face security challenges due to the lack of support for alternate data transfer protocols like MQTT and CoAP, which are not adequately protected by traditional network firewalls, leading to reduced security for cloud resources, especially when multiple protocols are used from the same client device.
Innovation Solution
Implementing a role-based access control system within cloud computing systems that uses a resource access controller to manage access to cloud resources based on client device processes, employing a process data store, role data store, and access request processor to authenticate and authorize access, and dynamically adjust roles for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network firewalls are used to protect cloud resources, then HTTP communications are adequately protected, but alternate protocols like MQTT and CoAP are not adequately protected
Solution Approach 1:
The patent introduces an intermediary component (firewall rule generator or proxy server) that sits between the traditional firewall and the cloud resources. This intermediary translates or adapts alternate protocols like MQTT and CoAP into formats that traditional firewalls can inspect and control, thereby extending security coverage to non-HTTP protocols without modifying the core firewall infrastructure.
Solution Approach 2:
The system dynamically changes security parameters (such as allowed ports, data patterns, connection states) based on the detected protocol type. When MQTT or CoAP traffic is identified, the system adjusts firewall rules to match the specific characteristics of these protocols, enabling effective security control adapted to each protocol's requirements.
2Adaptability or versatility
If multiple alternate protocols are allowed from the same client device, then data transfer flexibility is improved, but security control becomes more complex
Solution Approach 1:
The patent implements a universal firewall rule generation mechanism that handles multiple protocols (HTTP, MQTT, CoAP, and others) through a single unified approach. The system identifies the protocol type and automatically generates appropriate security rules, eliminating the need for separate complex rule sets for each protocol and simplifying overall firewall management.
Solution Approach 2:
The firewall system performs self-service by automatically detecting the protocol being used and generating the appropriate security rules without requiring manual configuration for each protocol. This automation reduces operational complexity and allows the system to adapt to new protocols dynamically.
3Reliability
If role-based access control is implemented, then security is enhanced through least privilege principle, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-defining roles and their associated permissions before access requests occur. The system maintains a role database that maps roles to specific resource access permissions, allowing the firewall to quickly determine whether an access request is valid by simply checking the client's role against the pre-configured rules, rather than evaluating complex access criteria in real-time.
Data Source
AI summary
Systems and methods for role-based access control to computing resources are presented. In an example embodiment, a request to perform a type of access of a computing resource is received via a communication network from a process executing on a client device. Using a data store storing process identifiers and associated access control information, access control information associated with the requesting process is identified based on a process identifier of the requesting process. Based on the access control information associated with the requesting process, a determination is made whether the requesting process is allowed to perform the requested type of access of the computing resource. The request is processed based on the requesting process being allowed to perform the requested type of access of the computing resource.