Application Instance Authentication via Self-Measurement Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In modern distributed and virtual computer systems, credential management is cumbersome, leading to application developers storing credentials within application code or avoiding them altogether, which compromises security by allowing unauthorized access.
Innovation Solution
Associating an identity and credential with each application version, using measurements to validate installed instances and enable secure access to resources, with features like unique application credentials, voucher associations, and automatic credential rotation in secure execution environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If credential management is implemented in distributed systems, then security is improved, but operational complexity increases
Solution Approach 1:
The application instance automatically performs self-measurement and provides its own credential without requiring manual credential management by developers or users. The system autonomously generates measurements of its execution state and uses these as credentials for authentication, eliminating the burden of credential distribution and management.
Solution Approach 2:
The patent transforms the credential from a static secret (password, API key) into a dynamic measurement that changes with each application instance and execution state. This parameter change allows credentials to be uniquely tied to specific application versions and execution environments, improving security while simplifying management through automatic generation.
2Ease of operation
If credentials are stored within application code, then ease of operation is improved, but security deteriorates
Solution Approach 1:
The patent replaces the mechanical approach of storing credentials in code with a measurement-based authentication system. Instead of embedding secrets in the application binary, the system measures the execution state of the application and uses this measurement as the credential, eliminating security vulnerabilities associated with hardcoded credentials.
Solution Approach 2:
The patent creates a copy of the application's execution state as a measurement credential. This measurement is a representation of the application's state that can be transmitted and verified without exposing the actual application code or sensitive information, thereby maintaining security while enabling authentication.
3Reliability
If application instances are validated using measurements, then security is improved, but device complexity increases
Solution Approach 1:
The measurement mechanism serves multiple functions: it acts as both the credential for authentication and the proof of application identity. The same measurement process that verifies the application's execution state also generates the authentication credential, eliminating the need for separate credential management systems and reducing overall system complexity.
Solution Approach 2:
The measurement acts as an intermediary between the application instance and the authentication system. Rather than requiring direct verification of application code or complex cryptographic protocols, the measurement serves as a simplified intermediary credential that can be easily transmitted and verified by remote services.
Data Source
AI summary
A computer-implemented system and method for receiving a request to associate one or more application instance definitions with an application identity of an application configured with a set of permissions to access computer resources in an environment of a computing resource service provider. The system and method cause a computer system to store the one or more application instance definitions in association with the application identity of the application. The system and method also cause the computer system to evaluate a request originating from an application corresponding to the application identity and the application instance definition to determine if fulfillment of the request complies with the permissions.