Runtime Sensor Context Enrichment for Cloud Identity Misuse
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identity misuse in cloud computing environments poses significant risks, including unauthorized access to sensitive information, cybercrime facilitation, and erosion of trust in digital systems, necessitating robust security measures to mitigate these threats.
Innovation Solution
Deploying a runtime sensor in a cloud computing environment to detect events, associate runtime processes with these events, generate enriched events, apply policies, and initiate mitigation actions such as blocking network traffic or sandboxing workloads when policy conditions are not met, leveraging a sensor backend server and inspection controller to monitor and secure the environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional identity management systems are used in cloud computing environments, then implementation is simpler, but security against identity misuse is insufficient
Solution Approach 1:
The patent embeds runtime sensors within workload processes, creating a nested monitoring structure where the sensor operates inside the workload context. This allows security monitoring at the process level without requiring a complete external system overhaul, thus improving security while managing complexity
Solution Approach 2:
The runtime sensor acts as an intermediary between the workload process and the security policy enforcement mechanism. It intercepts and enriches events with contextual information before policy evaluation, providing a middle layer that enhances security without directly complicating the core identity management system
2Measurement precision
If runtime sensors are deployed to detect identity misuse, then security detection capability is improved, but processing overhead increases
Solution Approach 1:
The runtime sensor applies partial action by selectively enriching only those events that are relevant to security policies. Instead of processing all workload events equally, it focuses computational resources on suspicious or policy-critical events, improving detection accuracy while reducing overall processing overhead
Solution Approach 2:
The sensor performs preliminary enrichment of events with contextual information before they reach the policy evaluation stage. This preliminary action prepares data in advance, enabling more accurate detection without increasing the computational burden during critical security evaluation moments
3Measurement precision
If events are enriched with runtime context, then policy evaluation accuracy is improved, but data processing time increases
Solution Approach 1:
The runtime sensor performs enrichment of events with contextual information in advance, before policy evaluation begins. This preliminary action ensures that when policies are evaluated, all necessary contextual data is already available, improving accuracy without adding time pressure to the evaluation process itself
Solution Approach 2:
The system skips unnecessary processing steps by directly injecting pre-collected runtime context into events. Instead of gathering contextual information during policy evaluation, the sensor has already captured and prepared this data, allowing the evaluation process to move quickly through enriched events
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for preventing cloud identity misuse in a cloud computing environment is presented. The method includes: deploying a runtime sensor on a workload in a cloud computing environment; detecting an event in a cloud log, the event including an identifier of the workload; associating a runtime process detected by the runtime sensor on the workload with the event detected in the cloud log; generating an enriched event based on: the detected event, and an identifier of the associated runtime process; applying a policy on the enriched event; and initiating a mitigation action in the cloud computing environment based on a result of applying the policy on the enriched event.