Cloud Trust Boundary Extension Using Identity-Based Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for extending trust boundaries between cloud domains of the same entity, such as VPNs and IPSec, are cumbersome to configure, slow, and insecure, with high administrative overhead and potential security risks.
Innovation Solution
A network protocol and architecture that uses identity-based policies and secure gateways with implicit certificates or tokens to automatically distinguish and trust traffic between cloud domains of the same entity, leveraging TLS or UDP with JSON Web Tokens for authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VPNs are used to extend trust boundary between cloud domains, then security is improved, but device complexity and administrative overhead increase significantly
Solution Approach 1:
The patent extracts the essential security function (trust verification) from the complex VPN infrastructure. Instead of using full VPN protocols with their extensive configuration requirements, the invention extracts only the necessary authentication mechanism using TLS certificates and identity-based policies, eliminating unnecessary VPN complexity while maintaining security.
Solution Approach 2:
The patent introduces an intermediary trust verification mechanism using TLS certificates and identity-based policies. Rather than directly establishing VPN connections between domains, the system uses certificate-based authentication as an intermediary layer that simplifies the trust establishment process while maintaining security.
2Reliability
If IPSec with digital certificates is used for tunnel authentication, then security is improved, but ease of operation deteriorates due to administrative complexity
Solution Approach 1:
The patent makes the certificate authentication system universal by implementing identity-based policies that can be applied across multiple cloud domains and services. Instead of configuring separate IPSec tunnels for each domain pair, the system uses a universal certificate-based authentication mechanism that works across all domains, significantly reducing administrative complexity.
Solution Approach 2:
The patent enables self-service authentication where domains automatically verify each other's identities using TLS certificates and pre-configured identity-based policies. The system eliminates the need for manual tunnel configuration and certificate management between domains, as the authentication process is automated through the established trust policies.
3Reliability
If traditional VPN solutions are deployed, then trust boundary extension is achieved, but productivity decreases due to setup and maintenance overhead
Solution Approach 1:
The patent performs preliminary action by pre-configuring identity-based policies and TLS certificates before inter-domain communication is needed. Instead of setting up VPN connections on-demand, the system establishes trust relationships in advance through automated certificate issuance and policy configuration, enabling rapid deployment and eliminating time-consuming setup processes.
Solution Approach 2:
The patent implements self-service mechanisms where the system automatically manages certificate lifecycle, policy enforcement, and trust verification without manual intervention. This eliminates the productivity drain of manual VPN configuration and maintenance, as the system autonomously handles all authentication and trust management tasks.
4Ease of operation
If long expiry time certificates are used in IPSec, then ease of operation is improved, but reliability deteriorates due to higher security risk
Solution Approach 1:
The patent implements periodic action by using short-lived certificates that are automatically renewed. Instead of using long-expiry certificates that pose security risks, the system issues certificates with limited validity periods and automatically renews them, maintaining both security (through frequent rotation) and ease of operation (through automation).
Solution Approach 2:
The patent enables self-service certificate renewal where the system automatically manages the certificate lifecycle including issuance, rotation, and revocation. This eliminates the need for manual certificate management while maintaining security through automated short-lived certificate usage, resolving the contradiction between operational simplicity and security risk.
Data Source
AI summary
A network protocol and architecture for extending trust between cloud domains of a same entity comprises adding, by egress logic executing on a first server, authentication information to a packet leaving a first cloud domain of the entity to indicate a source of the packet. The egress logic allows the packet to traverse to a target cloud domain of the entity. Ingress logic executing on a second server at the target cloud domain intercepts the packet and performs validation of the authentication information. Responsive to the authentication information passing validation, the ingress logic determines that the first cloud domain is trusted and allows the packet to proceed to a destination. Responsive to the authentication information failing validation, the ingress logic rejects the packet.