Delegated Authentication for Secure Workflows From Unsecure Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Devices with varying security levels, such as scanners and printers, are unable to implement modern authentication practices due to operating system incompatibilities, posing a security risk when user credentials are directly provided for accessing cloud-based resources.
Innovation Solution
A cloud-based delegated authenticator initiates authentication on behalf of unsecure devices, receiving credentials from a secure device and executing operations on permission-controlled resources without exposing the unsecure device to credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user credentials are provided directly to unsecure devices for accessing cloud resources, then ease of operation is improved, but security is worsened
Solution Approach 1:
A cloud-based delegated authenticator is introduced as an intermediary between the unsecure device and the permission-controlled resource. The unsecure device sends a delegation instruction to the authenticator, which then handles the authentication process by receiving credentials from a secure device and executing operations on behalf of the unsecure device without exposing credentials to it.
2Object-affected harmful factors
If unsecure devices are excluded from direct authentication, then security is improved, but device versatility is worsened
Solution Approach 1:
The cloud-based delegated authenticator serves multiple functions: it receives delegation instructions from unsecure devices, initiates authentication processes, receives credentials from secure devices, and executes operations on permission-controlled resources. This universal service enables both secure devices and unsecure devices to access cloud resources through a unified authentication mechanism.
3Object-affected harmful factors
If a cloud-based delegated authenticator is introduced, then security is improved, but system complexity is worsened
Solution Approach 1:
The cloud-based delegated authenticator autonomously handles the authentication process without requiring manual intervention. It automatically receives delegation instructions from unsecure devices, initiates credential collection from secure devices, verifies credentials, and executes operations on permission-controlled resources, thereby managing the increased system complexity through automated self-service mechanisms.
Data Source
AI summary
A disclosed method allows an unsecure device to initiate a user workflow contingent upon access to a permission-controlled resource. The method includes receiving, from the unsecure device, a delegation instruction including: a first token associated with a first entity registered with a cloud service platform; a request to execute an operation on a permission-controlled resource associated with a second entity registered with the cloud service platform; and a user identifier for the second entity. The method includes transmitting a notification to a storage location identified based on the user identifier, the notification includes an instruction that a user can follow to provide an access credential associated with the permission-controlled resource. The method further provides for executing the operation on the permission-controlled resource in response to receiving a second token generated in response to verification of the access credential.