Multi-Tenant Service Policy Authorization via Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud infrastructure systems face challenges with broad access power, lack of fine-grained access control, and transparent auditing in service-to-service communications, particularly in multi-tenant environments, where hundreds of services interact and require scalable authentication solutions.
Innovation Solution
Implementing a system policy approach for authorization in a multi-tenant service-oriented architecture, where policies defined by both the tenant administrator and the cloud solutions provider govern access, eliminating the need for mutual transport layer security (mTLS) connections, and utilizing a policy store to evaluate and enforce these policies for authentication and authorization decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mTLS/SSL mutual transport layer security is used for service-to-service authentication, then authentication and authorization are established between services, but broad access power is granted to caller services and fine-grained access control is lost
Solution Approach 1:
The patent segments the authentication and authorization process into distinct components: identity verification through mTLS certificates is separated from authorization decisions through policy evaluation. This allows the system to maintain reliable authentication while implementing fine-grained access control through separate policy rules that can be evaluated independently of the cryptographic handshake.
Solution Approach 2:
The patent introduces an intermediary authorization service that acts as a mediator between the mTLS authentication layer and the resource access layer. This service receives authenticated service identities, evaluates them against stored policies, and makes authorization decisions. The intermediary decouples authentication from authorization, enabling fine-grained control without compromising authentication reliability.
2Reliability
If mTLS connections are established between all services, then service authentication is achieved, but the complexity of setting up and managing certificates increases significantly
Solution Approach 1:
The patent implements a universal certificate authority that issues certificates to all services in the multi-tenant system. Instead of requiring separate certificate management between each service pair, a single trusted CA provides certificates that all services can use for mutual authentication. This universal approach maintains reliable service authentication while dramatically reducing certificate management complexity.
Solution Approach 2:
The system enables services to automatically obtain and manage their own certificates through the centralized authorization service. Services can request certificates, renew them, and have them automatically revoked or updated without manual intervention. This self-service capability maintains authentication reliability while eliminating the operational burden of manual certificate management.
3Ease of operation
If broad access rights are granted to services for simplicity, then service-to-service communication is easier to implement, but auditing transparency and fine-grained security control are lost
Solution Approach 1:
The patent implements comprehensive feedback mechanisms through audit logging that track every authorization decision. The authorization service logs which service accessed which resource, what action was taken, and what policy rules were evaluated. This feedback provides full auditing transparency while maintaining simple service communication, as services don't need to understand the complex policy evaluation process - they simply make requests and receive authorized responses with complete audit trails.
Solution Approach 2:
The authorization service acts as an intermediary that transparently evaluates policies between services and resources. Services can communicate simply without worrying about access control details, while the intermediary enforces fine-grained security and provides auditing information. This mediator approach maintains communication simplicity while preventing information loss through comprehensive policy evaluation and logging.
Data Source
AI summary
Systems, methods, and other embodiments associated with controlling a multi-tenant service-oriented architecture are described. In one embodiment, a method includes providing a collection of policies based upon who can access information of a user, wherein the information of the user is managed by a second service. A multi-tenant control module determines if a first service is able to contact the second service and obtain access to the user's information through the second service. An authentication service works in conjunction with the first and second services to assist in determining if the first service is able to contact the second service and obtain access to the user's information through the second service.