Distributed Credential Validation via Segmented Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In conventional cloud computing environments, the commingling of authorities for application behavior and cloud controller permissions can lead to undesirable privilege escalation, as authentication systems often require a union of permissions from multiple components, compromising security.
Innovation Solution
A distributed validation technique where a de-privileged token with partial access rights is issued, allowing separate authentication by the cloud controller through a securely encrypted channel, preventing the mingling of application-level and cloud controller permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a union of permissions from multiple components is used for authentication, then authentication completeness is improved, but security deteriorates due to privilege escalation and commingling of authorities
Solution Approach 1:
The patent segments authentication into two distinct stages: first stage authentication with a de-privileged token containing only application-level authorities, and second stage authentication where the cloud controller separately validates cloud controller permissions. This segmentation prevents the commingling of authorities by ensuring that application-level and cloud controller permissions are validated separately and never combined in a single token, thereby resolving the contradiction between authentication completeness and security.
2Measurement precision
If complete authentication information is passed to all components, then authentication accuracy is improved, but device complexity increases due to the need to manage and validate multiple permission sets
Solution Approach 1:
The patent extracts cloud controller permission validation from the application authentication flow. The cloud controller separately validates cloud controller permissions independently of the application-level authentication. This extraction reduces device complexity by eliminating the need for applications to manage and validate cloud controller permissions, while maintaining authentication accuracy through separate validation by the authoritative cloud controller component.
3Object-affected harmful factors
If separate authentication channels are used for different components, then security is improved, but productivity decreases due to multiple authentication steps
Solution Approach 1:
The patent implements preliminary action by having the user authenticate once with the cloud controller before the application invocation. The cloud controller pre-validates cloud controller permissions and includes this validation result in the de-privileged token. This preliminary authentication step eliminates the need for repeated cloud controller permission validation during application execution, thereby maintaining security while improving productivity by reducing redundant authentication steps.
Data Source
Figure 1
Figure 2
AI summary
Systems, methods, and computer program products for distributed validation of credentials are described. Upon receiving a request to perform an action by a user, a system performs a multi-part authentication where in each part, only a portion of authentication information is passed. In a first stage, an application manager of the system receives a first token than specifies partial access rights. In a second stage, a cloud controller of the system requests and receives privileges of the user separately from the first token. An API is presented with a token that only contains the authorities that the API needs, while still allowing validation of cloud controller permissions without having to escalate the user's privileges.