Stacked Resource Identifiers for Cloud Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, resources within a logical container often cannot interact with each other due to different security domains and lack of access control, leading to complexities in managing access privileges and potential unintended privilege escalations.
Innovation Solution
The use of stacked identifiers, which map a base identifier to a second identifier, allowing resource principals to act in a specific capacity and interact with other resources by presenting themselves as logical resources within a client tenancy, along with short-lived digital tokens and token renewal mechanisms for controlled access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If resources are organized into different logical containers with separate security domains, then security isolation is improved, but resource interaction capability deteriorates
Solution Approach 1:
The patent introduces a stacked identifier as an intermediary mechanism that bridges resources across different logical containers. The stacked identifier contains both the base identifier (from the infrastructure layer) and the logical resource identifier (from the client tenancy layer), enabling resources to interact across security domains while maintaining isolation. This resolves the contradiction by providing a controlled interaction pathway without compromising security boundaries.
2Adaptability or versatility
If traditional access control mechanisms are used across multiple security domains, then access management flexibility is improved, but system complexity deteriorates
Solution Approach 1:
The patent merges the base identifier and logical resource identifier into a single stacked identifier structure. This combination eliminates the need for separate access control mechanisms for each security domain, as the stacked identifier inherently encodes the hierarchical relationship between infrastructure resources and logical resources. The simplification reduces system complexity while maintaining flexible access management across multiple domains.
3Measurement precision
If resources are assigned multiple identifiers for different security domains, then access control precision is improved, but credential management complexity deteriorates
Solution Approach 1:
The stacked identifier implements a nested structure where the logical resource identifier is embedded within the base identifier framework. This nesting allows the system to maintain precise access control by preserving both identifier levels while managing credentials through a single unified stacked identifier. The nested structure eliminates the need for separate credential management for each identifier level, reducing complexity while maintaining access control precision.
Data Source
AI summary
Techniques are described for enabling resources within a cloud computing system to interact with each other. In certain embodiments, a base identifier assigned to a first resource is extended by mapping the base identifier onto a second identifier assigned to a logical resource that is built upon the first resource. This allows the first resource to have two identities, one identity indicating what the first resource is (e.g., a particular compute instance) and another identity indicating the purpose of the first resource (e.g., operating as a database for a particular tenancy). Consequently, the first resource may be provided with access privileges different from those associated with the base identifier. For example, the first resource may access another resource in the tenancy using the second identifier, but may have no access to the other resource using the base identifier.