Method and system for visibility and control over access transactions between clouds using resource authorization messages

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to
• detect an access transaction comprising one or more resource authorization messages transmitted via a resource authorization protocol, the access transaction pertaining to a consumer cloud requesting access to a protected resource, the protected resource hosted by a provider cloud;
• generate relationship data based on the resource authorization messages, the relationship data indicating the provider cloud hosting the protected resource, the consumer cloud requesting access, and a resource owner that is granting the access;
• identify a trust cloud type assigned to the consumer cloud;
• and
• perform an access control action in relation to the access transaction based on the relationship data, policy data and the trust cloud type assigned to the consumer cloud, wherein the access control action is at least one of allowing the consumer cloud access to the protected resource or denying the consumer cloud access to the protected resource.

A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform a method comprising:

• detecting an access transaction comprising one or more resource authorization messages transmitted via a resource authorization protocol, the access transaction pertaining to a consumer cloud requesting access to a protected resource hosted by a provider cloud;
• generating, by the processor, relationship data based on the resource authorization messages, the relationship data indicating the provider cloud hosting the protected resource, the consumer cloud requesting access, and a resource owner that is granting the access;
• identifying a trust cloud type assigned to the consumer cloud:
• and
• performing an access control action in relation to the access transaction based on the relationship data, policy data and the trust cloud type assigned to the consumer cloud, wherein the access control action is at least one of allowing the consumer cloud access to the protected resource or denying the consumer cloud access to the protected resource.