Session-Specific Attributes for Cloud Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing fine-grained permissions to cloud-based resources for a large number of users in an organization is complex, requiring multiple roles and increasing administrative effort, especially when users work on multiple projects simultaneously, and tracking user activities becomes difficult due to the need for scanning logs and identifying session roles.
Innovation Solution
Implementing attribute-based rules that allow entities to assume roles with pre-defined or specified attributes, stored as session data, which are evaluated against role trust and permission rules to grant access to resources, reducing the need for multiple roles and simplifying access management by using session-specific attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If administrators create multiple roles to manage fine-grained permissions for users working on multiple projects, then access control precision is improved, but device complexity and administrative effort increase
Solution Approach 1:
The patent segments access control into two independent layers: roles (which remain minimal in number) and attributes (which provide fine-grained control). Instead of creating multiple roles for different projects, the system attaches project-specific attributes to sessions, allowing precise access control without increasing role complexity. This segmentation resolves the contradiction by moving granularity from the role level to the attribute level.
Solution Approach 2:
The patent adds a temporal dimension to access control by introducing session-specific attributes that can be dynamically assigned and removed. This allows the same user role to have different attribute sets across different sessions, enabling fine-grained control without creating multiple static roles. The dimensionality change from static role-based control to dynamic session-based control resolves the complexity issue.
2Manufacturing precision
If administrators create multiple roles for each user in the organization, then access control precision is improved, but ease of operation deteriorates due to increased administrative effort
Solution Approach 1:
The patent makes the attribute system universal and reusable across all users and roles. A single attribute definition (e.g., project tag) can be applied to multiple users, roles, and sessions simultaneously. This universality allows administrators to manage fine-grained access control with a single configuration rather than creating and maintaining multiple user-specific roles, significantly reducing administrative effort while preserving precision.
Solution Approach 2:
The patent enables copying of attribute sets across sessions and users. Once an attribute configuration is created for one user or role, it can be replicated and applied elsewhere without reconfiguration. This copying mechanism allows rapid deployment of consistent access control policies across the organization, reducing the time and effort required for administrative setup and maintenance.
3Device complexity
If one role per group is used, then device complexity is reduced, but tracking user activities becomes difficult due to the need for scanning logs and identifying session roles
Solution Approach 1:
The patent implements feedback mechanisms that automatically log and report session attribute information. When users assume roles with specific attributes, the system automatically captures this information and makes it available for auditing and monitoring. This automated feedback eliminates the need for manual log scanning and role identification, making user activity tracking straightforward while maintaining a simple role structure.
Solution Approach 2:
The patent introduces session attributes as an intermediary layer between roles and resources. This intermediary carries identifying information that links user actions to specific projects and roles without requiring complex log analysis. The session attribute acts as a mediator that simplifies the tracking process by providing direct, machine-readable identification of user context.
4Adaptability or versatility
If multiple roles are created to accommodate users working on multiple projects, then adaptability is improved, but loss of time increases due to users needing to assume different roles for different tasks
Solution Approach 1:
The patent introduces dynamic attribute assignment that allows users to have different attribute sets for different sessions without changing their underlying role. Attributes can be dynamically added, modified, or removed based on the specific project or task context. This dynamic approach provides the adaptability of multiple roles while eliminating the time-consuming process of switching between them, as users maintain a single role with context-specific attributes applied only when needed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques for managing permissions to cloud-based resources with session-specific attributes are described. A first request to create a first session to permit access to resources of a provider network is received under an assumed role. The first request is permitted based on an evaluation of a rule associated with the role. Session data including a user-specified attribute included with the first request is generated. A second request to perform an action with a resource hosted by the provider network is received. The user-specified attribute is obtained from the session data based at least in part on the second request. The second request is permitted based on an evaluation of another rule with the user-specified attribute.