Fine granularity control of data access and usage across multi-tenant systems
System and method for fine granularity control of data access and usage for across multi-tenant systems. A user makes a request to access a particular set of data from a particular remote data source for a specific purpose. The system authorizes the user to validate whether the user is qualified to make the request. The data source is checked to see if the particular data has been granted access for that particular purpose. A cloud neutral token is created and converted into a cloud specific token upon reaching the remote data source. The cloud specific token is used to create a temporary IAM role and IAM policy with a predetermined time to live. After the time to live expires, the IAM role and IAM policy are deleted.
1 . A system comprising:
a processor;
memory, the memory storing instructions for executing a method, the method comprising:
receiving a request from a user to access a set of data from an associated data consent record at a remote data base for a specific purpose of developing or improving a machine learning (ML) feature;
as a first phase of a three-phase authorization process validating, based on a role of the user, that the user has permission to request data access for an application associated with the request;
verifying that the associated data consent record has granted the user access to the set of data for the specific purpose wherein the data consent record specifies the application, representing the machine learning feature, for which consent is granted and a list of consented data entities;
as a second phase of the three-phase authorization process and responsive to successful validation and verification, generating a context-based token that defines a data scope and an operation scope for the request;
generating a cloud neutral token from the context-based token and the associated data consent record
as a third phase of the three-phase authorization process, converting the cloud neutral token into a cloud specific token and verifying the cloud specific token with backend services of a remote cloud system to apply security scope for data and operations; and
in response to the user being authorized and verified via the three-phase authorization process:
creating a temporary Identity and Access Management (IAM) role and a temporary IAM policy that allows restricted access to the set of data by the user according to the cloud specific token the temporary IAM role and policy being associated with a time to live value, and
automatically deleting the temporary IAM role and temporary IAM policy after the time to live value expires.
2 . The system of claim 1 , wherein the remote cloud system grants access via a data consent process.
3 . The system of claim 1 , wherein validating the user includes validating that the user is part of a team and project that has been granted access from the remote cloud system for that specific purpose.
4 . The system of claim 1 , wherein validating the user does not immediately grant access to the set of data.
5 . The system of claim 1 , wherein after the user is authorized and has access to the set of data, the user can only access the data for the specific purpose and not any other purpose.
6 . The system of claim 1 , wherein the specific purpose is enforced via tagging resources with tags corresponding to an application context field specified in the cloud neutral token.
7 . The system of claim 6 , wherein after the time to live expires the tags are also deleted.
8 . A method comprising:
receiving a request from a user to access a set of data from an associated data consent record at a remote data base for a specific purpose of developing or improving a machine learning (ML) feature;
as a first phase of a three-phase authorization process validating, based on a role of the user, that the user has permission to request data access for an application associated with the request;
verifying that the associated data consent record has granted the user access to the set of data for the specific purpose wherein the data consent record specifies the application, representing the machine learning feature, for which consent is granted and a list of consented data entities;
as a second phase of the three-phase authorization process and responsive to successful validation and verification, generating a context-based token that defines a data scope and an operation scope for the request;
generating a cloud neutral token from the context-based token and the associated data consent record
as a third phase of the three-phase authorization process, converting the cloud neutral token into a cloud specific token and verifying the cloud specific token with backend services of a remote cloud system to apply security scope for data and operations; and
in response to the user being authorized and verified via the three-phase authorization process:
creating a temporary Identity and Access Management (IAM) role and a temporary IAM policy that allows restricted access to the set of data by the user according to the cloud specific token the temporary IAM role and policy being associated with a time to live value, and
automatically deleting the temporary IAM role and temporary IAM policy after the time to live value expires.
9 . The method of claim 8 , wherein the remote cloud system grants access via a data consent process.
10 . The method of claim 8 , wherein validating the user includes validating that the user is part of a team and project that has been granted access from the remote cloud system for that specific purpose.
11 . The method of claim 8 , wherein validating the user does not immediately grant access to the set of data.
12 . The method of claim 8 , wherein after the user is authorized and has access to the set of data, the user can only access the data for the specific purpose and not any other purpose.
13 . The method of claim 8 , wherein the specific purpose is enforced via tagging resources with tags corresponding to an application context field specified in the cloud neutral token.
14 . The method of claim 13 , wherein after the time to live expires the tags are also deleted.
15 . A non-transitory computer readable medium storing instructions to cause a processor to execute a method, the method comprising:
receiving a request from a user to access a set of data from an associated data consent record at a remote data base for a specific purpose of developing or improving a machine learning (ML) feature;
as a first phase of a three-phase authorization process validating, based on a role of the user, that the user has permission to request data access for an application associated with the request;
verifying that the associated data consent record has granted the user access to the set of data for the specific purpose wherein the data consent record specifies the application, representing the machine learning feature, for which consent is granted and a list of consented data entities;
as a second phase of the three-phase authorization process and responsive to successful validation and verification, generating a context-based token that defines a data scope and an operation scope for the request;
generating a cloud neutral token from the context-based token and the associated data consent record
as a third phase of the three-phase authorization process, converting the cloud neutral token into a cloud specific token and verifying the cloud specific token with backend services of a remote cloud system to apply security scope for data and operations; and
in response to the user being authorized and verified via the three-phase authorization process:
creating a temporary Identity and Access Management (IAM) role and a temporary IAM policy that allows restricted access to the set of data by the user according to the cloud specific token the temporary IAM role and policy being associated with a time to live value, and
automatically deleting the temporary IAM role and temporary IAM policy after the time to live value expires.
16 . The method of claim 8 , wherein the time to live value is defined within the cloud neutral token.
17 . The method of claim 8 , wherein the method further comprises attaching a resource tag, encoding the specific purpose and a project identifier, to the temporary IAM role, and wherein access to a data resource is denied unless the resource tag matches a corresponding tag on the data resource.
18 . The method of claim 17 , wherein the temporary IAM policy is further configured to restrict the temporary IAM role to access only specific cloud services and data storage locations based on the operation scope defined in the cloud neutral token.
19 . The method of claim 8 , wherein verifying the cloud specific token with the backend services comprises transmitting the token to a cloud provider's IAM endpoint and receiving a validation response that confirms the permissions encoded in the token are authorized and within the applied security scope.
20 . The method of claim 8 , wherein the cloud neutral token includes a field specifying one or more consented data entities from the data consent record, and wherein the temporary IAM policy is configured to permit access only to those specified data entities.