Tenant Lockbox Mediates Cloud Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud service systems, customers lack control over access to their data, leading to increased scrutiny as support personnel may access customer data without transparency regarding their access permissions and frequency, which raises concerns about security and compliance.
Innovation Solution
A tenant lockbox system that computes the necessary role for operator access, sends access control requests to internal and tenant administrators for approval, and temporarily elevates operator permissions to allow specific actions on tenant data, enabling tenants to control and scrutinize access according to their procedures and compliance needs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cloud service providers allow support personnel to access customer data for service operations, then service quality and customer support capability are improved, but data security and customer control are worsened
Solution Approach 1:
The patent introduces a lockbox mechanism as an intermediary between support personnel and customer data. This lockbox requires customer approval tokens before granting access, effectively mediating the access process to maintain both service capability and security. The lockbox acts as a controlled gateway that enables necessary access while preserving customer control and data security.
2Reliability
If cloud service providers implement access control systems for support personnel, then data security is improved, but access efficiency and operational speed are worsened
Solution Approach 1:
The patent implements preliminary action by having customers pre-configure approval tokens and access policies before support personnel need access. These pre-configured tokens are stored in the lockbox and can be automatically presented when access is requested, eliminating the need for real-time approval processes and maintaining high access efficiency while ensuring security compliance.
Solution Approach 2:
The lockbox system enables self-service by allowing customers to autonomously manage their own access control policies and approve or deny access requests without requiring cloud provider intervention. This self-managed approach streamlines the access process while maintaining customer control over their data security.
3Adaptability or versatility
If cloud service providers store business-critical customer data in the cloud, then service scalability and accessibility are improved, but customer control over data access is worsened
Solution Approach 1:
The patent segments the access control mechanism into distinct components: customer-managed policies, lockbox storage, and support personnel access requests. This segmentation allows customers to maintain control over their data access policies while the cloud provider maintains scalable data storage and accessibility. The separation of concerns enables both cloud scalability and customer control to coexist effectively.
Data Source
AI summary
Tenant approval for operator access to tenant data is provided. In order to grant service personnel operators access to a tenant's data for performing a requested action, a lockbox determines a security group role to which an operator needs to be elevated to perform a requested action, computes a set of internal administrators and tenant administrators authorized to grant a temporary role elevation, and sends an access control request to the administrators. Upon receiving approval of the access control request from an internal administrator and a tenant administrator, the lockbox elevates the operator to the security group role, granting the operator a set of permissions needed in order to allow the operator to perform the requested action. Accordingly, tenants are enabled to control access to their data and scrutinize access requests per their company procedures and compliance needs.