Secure Channel Access for Multi-Account Vendor I/O Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing platforms face challenges in securely managing access for third-party vendors across multiple customer environments, leading to potential security issues and scalability limitations when granting and rotating credentials, especially in multi-cloud setups.
Innovation Solution
A system and method for establishing a secure channel between a vendor computing device and customer computing resources, using a single access control policy key and secure storage to manage access rights programmatically, allowing vendors to access customer environments without sharing credentials, and enabling automated credential rotation and ownership.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If credential sharing is used to enable vendor access to multiple customer accounts, then ease of operation is improved, but security deteriorates
Solution Approach 1:
The patent segments credential access by creating separate credential sets for each customer account while enabling a single vendor device to securely manage all segments. The system divides access control into account-specific credential pairs (private and public keys) that are individually managed but collectively accessible through centralized secure storage on the vendor device.
Solution Approach 2:
The patent introduces an intermediary secure channel mechanism that mediates between the vendor device and customer accounts. The secure channel, established through cryptographic protocols, acts as a trusted intermediary that enables credential verification without exposing actual credential values, thus maintaining security while facilitating operations.
2Adaptability or versatility
If multiple credential pairs are managed across customer accounts, then adaptability is improved, but device complexity deteriorates
Solution Approach 1:
The patent applies universality by designing a single vendor device with multi-functional capability to handle credential management across multiple customer accounts. The device universally stores, manages, and utilizes credential pairs for different accounts through a unified secure storage system and integrated cryptographic processing, eliminating the need for separate management systems for each account.
Solution Approach 2:
The system enables self-service through automated credential generation, storage, and rotation mechanisms. The vendor device automatically manages the lifecycle of credential pairs including generation, secure storage, retrieval, and rotation without requiring manual intervention for each credential operation, reducing complexity while maintaining adaptability.
3Reliability
If credential rotation is automated, then reliability is improved, but loss of time deteriorates
Solution Approach 1:
The patent implements preliminary action by pre-generating and securely storing multiple credential pairs before they are needed. The system proactively rotates credentials according to predefined policies, performing credential updates in advance before potential security issues arise, thus maintaining reliability while minimizing operational disruption and time loss.
Data Source
AI summary
Systems and methods for sharing secure channel access for the management of multiple computing resources are herein disclosed. According to one embodiment, an Information Handling System (IHS) includes computer-executable instructions to receive a plurality of Input/Output (I/O) requests from the vendor computing device in which the I/O requests are directed to one of the customer computing resources. The instructions may also establish a secure channel between the vendor computing device and the one customer computing resource, and send the first I/O requests to the one customer computing resource through the secure channel.