Credential Broker for Hybrid Cloud Kerberos Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In hybrid cloud environments, the Kerberos authentication protocol requires significant firewall openings and persistent credential storage, which compromises security and complicates authentication across different platforms, especially when physical hardware is shared and security measures are not uniformly controlled.

Innovation Solution

A credential broker system that interfaces with a token software development kit (SDK) to request and manage Kerberos service tickets, reducing the need for direct communication with a key distribution center and eliminating the need for persistent credential storage by using in-memory authentication tokens, thus enhancing security and simplifying authentication across various workloads and platforms.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If Kerberos authentication protocol is used in hybrid cloud environments, then secure authentication is achieved, but firewall openings and persistent credential storage are required which compromise security

Engineering Contradiction:

Improveauthentication securityVSAvoidfirewall openings and credential exposure

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

A credential broker is introduced as an intermediary component between the Kerberos authentication system and the hybrid cloud environment. The broker manages credential requests, obtains service tickets from the Kerberos Key Distribution Center, and provides them to applications without requiring direct Kerberos integration in each application. This intermediary approach maintains authentication security while reducing the need for widespread firewall openings and persistent credential storage across the hybrid cloud infrastructure.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If direct communication with key distribution center is allowed, then Kerberos service tickets can be obtained, but firewall complexity increases

Engineering Contradiction:

Improveauthentication processVSAvoidfirewall configuration

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The credential broker serves as a centralized intermediary that handles all communications with the Kerberos Key Distribution Center. Applications communicate with the broker through simplified interfaces rather than implementing direct Kerberos protocols. This consolidation reduces firewall complexity by limiting direct Kerberos communication to a single broker component rather than multiple application servers across the hybrid cloud environment.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The credential broker provides universal authentication services to multiple applications and workloads within the hybrid cloud environment. A single broker instance can service numerous applications, eliminating the need for each application to have its own direct Kerberos communication channel. This multi-functional approach simplifies firewall configuration while maintaining ease of authentication operations across diverse workloads.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Ease of operation

If persistent credential storage is implemented, then authentication tokens are available, but security is compromised due to credential exposure

Engineering Contradiction:

Improveauthentication availabilityVSAvoidcredential exposure

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system implements temporary credential storage with automatic expiration and cleanup. Service tickets obtained from the Kerberos Key Distribution Center are stored in memory only for the duration needed to complete authentication operations, then discarded. This approach maintains authentication availability during the active session while eliminating the security risks associated with persistent credential storage on disk or in long-term repositories within the hybrid cloud environment.

Inventive Principle:

Principle #34Discarding and recovering

Solution Approach 2:

Authentication credentials are treated as short-lived, disposable objects rather than persistent assets. Each service ticket is generated, used immediately for authentication, and then discarded. This disposable credential approach ensures that even if credentials are compromised, the window of vulnerability is minimal. The credential broker manages this lifecycle automatically, providing ease of operation while minimizing credential exposure risks in the hybrid cloud environment.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS20250023859A1Systems and methods for authentication brokering

Publication Date: 2025.01.16 JPMORGAN CHASE BANK NA

AI summary

In some aspects, the techniques described herein relate to a method including: receiving, at a credential broker, a request including a unique identifier of a client application, wherein the request is from a token software development kit; querying, by the credential broker, an application attestation datastore using the unique identifier of the client application as a lookup key; receiving, at the credential broker and as a result of the querying, a service identifier for a network service; requesting a service ticket from a key distribution center, wherein the service ticket facilitates authentication with the network service; and responding to the token software development kit with a return communication, wherein the return communication includes the service ticket.