Velocity-Based Cloud Access Detection via Managed Proxy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud computing platforms lack effective mechanisms to detect unauthorized access attempts, as they do not differentiate between secure and unsecured client devices, exposing enterprises to vulnerabilities and potential data breaches.
Innovation Solution
Implementing a method and system that utilize a managed proxy to detect unauthorized access by calculating the velocity between access attempts based on time and location, generating a velocity event if the computed velocity exceeds a threshold, thereby indicating unauthorized access and taking protective measures such as blocking access or raising security alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional authentication solutions (username and password) are used for cloud application access, then ease of operation is improved, but security is worsened because they do not differentiate between managed and unmanaged client devices
Solution Approach 1:
The patent changes the authentication parameters by introducing device-based identifiers (device ID, device type, OS type) and location information (IP address, geographic location) in addition to traditional credentials. The system computes a device score and location score based on these parameters to dynamically evaluate access requests, transforming static authentication into dynamic multi-parameter verification that distinguishes between managed and unmanaged devices.
2Reliability
If device-specific authentication is implemented to differentiate between managed and unmanaged devices, then security is improved, but device complexity is worsened due to multiple authentication factors
Solution Approach 1:
The patent segments the authentication evaluation into distinct modular components: device score computation (based on device ID, device type, OS type), location score computation (based on IP address and geographic location), and overall risk assessment. Each component independently evaluates specific parameters and can be configured separately, allowing the system to manage complexity through modular design while providing comprehensive security evaluation.
3Reliability
If velocity-based detection is implemented to identify unauthorized access, then security is improved, but measurement precision requirements are worsened due to need for accurate time and location tracking
Solution Approach 1:
The patent applies partial verification by not requiring extremely precise measurements for all access evaluations. Instead, it uses velocity thresholds that account for reasonable variations in timing and location data. The system computes velocity based on time differences and location changes but applies configurable thresholds that allow for measurement imprecisions while still effectively detecting suspicious access patterns, thus avoiding the need for excessive measurement precision.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for detecting unauthorized access to cloud applications based on velocity events are presented. The method includes identifying a first access attempt to a cloud application at a first time and from a first location; identifying a second access attempt to a cloud application at a second time and from a second location; computing a velocity between the first access attempt and the second access attempt based on the first time, the second time, the first location, and the second location; checking if the computed velocity is greater than a velocity threshold; and generating a velocity event when the computed velocity is greater than the velocity threshold, wherein the velocity event indicates that an access attempt is unauthorized.