Shadow Identity Authorization for Cloud Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the context of exploration and production (E&P) services hosted by cloud providers, there is a challenge in preventing individual clients from accessing proprietary data of different clients while providing them access to the same services, ensuring secure data isolation and access control.
Innovation Solution
The solution involves generating a shadow request with a shadow identity linked to the primary identity, which is authorized using native cloud provider authorization, resulting in a tenant token that allows access to a tenant data repository, ensuring that only authorized access is granted to proprietary data, and preventing developers of the E&P services provider from accessing client data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple clients share the same E&P services hosted by a cloud provider, then service utilization and resource efficiency are improved, but data security and client isolation are compromised
Solution Approach 1:
The patent segments client access by creating shadow identities and shadow requests that are isolated to specific tenant data repositories. Each client's shadow identity is authorized only for their own data, preventing cross-client access while allowing shared service infrastructure. This segmentation resolves the contradiction by enabling multi-client service sharing while maintaining individual data security boundaries.
Solution Approach 2:
The patent introduces shadow identities as intermediary entities between primary client identities and the cloud service infrastructure. These shadow identities act as mediators that enable service access while enforcing data isolation policies. The shadow request mechanism serves as an intermediary layer that translates primary requests into isolated, authorized operations, resolving the security concern while maintaining service sharing.
2Measurement precision
If native cloud authorization is used for shadow identity verification, then authorization accuracy and data isolation are improved, but system complexity increases
Solution Approach 1:
The patent leverages the universal native authorization services provided by cloud providers (such as Google Cloud's native authorization) to handle shadow identity verification. By using existing multi-functional cloud authorization infrastructure, the system achieves accurate data isolation without building complex custom authorization mechanisms. This resolves the contradiction by achieving high authorization accuracy through established cloud services rather than proprietary complex systems.
3Manufacturing precision
If shadow requests are generated for each primary request, then access control precision is improved, but processing overhead increases
Solution Approach 1:
The patent performs preliminary actions by pre-authorizing shadow identities and establishing their access rights to specific tenant data repositories before actual data operations occur. The shadow identity authorization is set up in advance, allowing subsequent shadow requests to be processed more efficiently. This resolves the contradiction by achieving precise access control through pre-established authorization rules rather than ad-hoc verification for each request.
Data Source
AI summary
A primary request is received that includes a primary identity. The service is within a service container group project hosted by a cloud provider. A shadow request is generated from the primary request. The shadow request includes a shadow identity linked to the primary identity. The shadow request is authorized by verifying that the shadow identity has access to the service. A tenant token is generated for the shadow identity in response to authorizing the shadow request. An access token is obtained using native authorization of the cloud provider in exchange for the tenant token. Tenant data is accessed from a tenant data repository using the access token. A shadow response is obtained that is generated for the shadow identity and includes processed tenant data generated. A primary response is sent that is for the primary identity and is generated from the shadow response.