User Access Mapping Service for Distributed Logging Auditability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed enterprise computing systems, the traditional approaches for logging user activity across multiple layers (SaaS, PaaS, IaaS) are not easily auditable due to different user management services and the use of temporary or anonymous users, leading to a complex web of access patterns and log locations that hinder auditability.
Innovation Solution
Implementing a user access mapping service that maintains associations between user accounts across layers and identifiers of real persons, storing these associations in access mappings, and including personal identifiers in log entries to facilitate easy auditability, even for temporary or anonymous users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional logging approaches are used in distributed enterprise computing systems with multiple user management services, then each layer can maintain its own logging independence, but auditability deteriorates due to the complex web of access patterns and log locations
Solution Approach 1:
The patent introduces an intermediary mechanism (correlation ID system and user access mapping service) that bridges multiple independent logging systems. Each layer continues to log independently with its own user management service, but a correlation identifier is propagated across layers to link logs. A mapping service stores associations between temporary/anonymous user identifiers and personal identifiers, enabling audit trails to be reconstructed across the distributed system without compromising layer independence.
2Adaptability or versatility
If temporary or anonymous users are used in cloud systems, then user access flexibility is improved, but the link between log entries and real persons is severed making audit reconstruction cumbersome
Solution Approach 1:
The patent implements preliminary action by establishing a user access mapping service that pre-stores the associations between temporary/anonymous user identifiers and personal identifiers before logging occurs. When a temporary user is created, the mapping service records the relationship between the anonymous identifier and the real person's identifier. This pre-established mapping enables later reconstruction of audit trails without requiring real-time correlation or manual intervention.
3Ease of manufacture
If each layer maintains separate logs with different user bases, then layer-specific logging requirements are met, but the complexity of analyzing multiple logs to determine user associations increases
Solution Approach 1:
The patent applies segmentation by allowing each layer to maintain its own independent logging system with its own user management service and log format. Each layer segments its logging responsibilities and user identification approaches according to its specific requirements. The correlation identifier acts as a common thread that segments yet connects these independent logging systems, enabling separate logging with unified auditability.
Data Source
AI summary
A system includes determination, at a first computing system, of the creation of a first user account, the first user account associated with a first username, a first identity store and a first person, determination, at the first computing system, of a first identifier uniquely identifying the first person, storage, at the first computing system, of a first association between the first username, the first identity store and the first identifier, reception, at a second computing system, of an indication of activity, the indication including the first username and the first identity store, determination, at the second computing system, the first identifier based on the first username, the first identity store and the stored first association, and creation, at the second computing system, of a log entry associating the activity with the first identifier.