Workload Sub-Identity Mediation for Cloud Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based workloads lack identities, making it difficult to enforce central policies and protect data, enforce access control, and manage access keys due to their dynamic characteristics.
Innovation Solution
A method to generate sub-identities for workloads based on information in payloads, enforce policies using these sub-identities, and convert them to keys before reaching external systems, while maintaining security and control within the cloud-based system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If workloads are made dynamic and scalable in cloud-based systems, then productivity and adaptability improve, but the ability to assign and enforce identities deteriorates
Solution Approach 1:
The patent introduces a cloud-based system as an intermediary between workloads and external systems. This intermediary assigns and manages identities dynamically, allowing workloads to remain flexible while still having enforceable identities. The system intercepts traffic, extracts identification information, and assigns identities as needed, resolving the contradiction between dynamicity and identity reliability.
Solution Approach 2:
The patent implements dynamic identity assignment where identities are not fixed but are assigned and reassigned based on workload characteristics and traffic patterns. The system continuously monitors workload behavior and adjusts identity assignments accordingly, enabling both adaptability and reliable identity management.
2Ease of operation
If access keys are shared with workloads to enable external system access, then ease of operation improves, but security deteriorates
Solution Approach 1:
The cloud-based system acts as an intermediary that receives keys from external systems and issues sub-identities to workloads instead of sharing the original keys. This mediator approach allows workloads to access external systems without receiving the master keys, eliminating the risk of key leakage while maintaining ease of operation.
Solution Approach 2:
The patent segments the identification mechanism into master keys held by the cloud system and sub-identities issued to workloads. This segmentation allows fine-grained control over access rights, enabling workloads to access specific external systems without receiving universal access keys, thus improving both security and operational ease.
3Object-affected harmful factors
If central policies are enforced on workload communications, then data protection improves, but device complexity increases
Solution Approach 1:
The cloud-based system serves as a centralized intermediary that handles all policy enforcement logic externally to the workloads themselves. The system intercepts communications, extracts identification information, and enforces policies centrally, protecting data without increasing the complexity of individual workload devices.
Solution Approach 2:
The patent implements a system where workloads automatically have identities assigned and policies enforced without manual configuration. The cloud system automatically extracts identification information from traffic, assigns appropriate identities, and applies policies, making the process self-service and reducing operational complexity.
Data Source
AI summary
Systems and methods for generating sub-identities for workloads in a cloud-based system. Various embodiments include receiving a key from an external system; generating one or more sub-identities from the key; assigning the one or more sub-identities to one or more workloads; and enforcing policies on the one or more workloads and traffic associated therewith based on the one or more sub-identities.