Distributed Credential Validation via Segmented Tokens

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

In conventional cloud computing environments, the commingling of authorities for application behavior and cloud controller permissions can lead to undesirable privilege escalation, as authentication systems often require a union of permissions from multiple components, compromising security.

Innovation Solution

A distributed validation technique where a de-privileged token with partial access rights is issued, allowing separate authentication by the cloud controller through a securely encrypted channel, preventing the mingling of application-level and cloud controller permissions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a union of permissions from multiple components is used for authentication, then authentication completeness is improved, but security deteriorates due to privilege escalation and commingling of authorities

Engineering Contradiction:
Improveauthentication completenessVSAvoidprivilege escalation
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments authentication into two distinct stages: first stage authentication with a de-privileged token containing only application-level authorities, and second stage authentication where the cloud controller separately validates cloud controller permissions. This segmentation prevents the commingling of authorities by ensuring that application-level and cloud controller permissions are validated separately and never combined in a single token, thereby resolving the contradiction between authentication completeness and security.

Inventive Principle:
Principle #1Segmentation

2Measurement precision

If complete authentication information is passed to all components, then authentication accuracy is improved, but device complexity increases due to the need to manage and validate multiple permission sets

Engineering Contradiction:
Improveauthentication accuracyVSAvoidpermission management complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent extracts cloud controller permission validation from the application authentication flow. The cloud controller separately validates cloud controller permissions independently of the application-level authentication. This extraction reduces device complexity by eliminating the need for applications to manage and validate cloud controller permissions, while maintaining authentication accuracy through separate validation by the authoritative cloud controller component.

Inventive Principle:
Principle #2Taking out (Extraction)

3Object-affected harmful factors

If separate authentication channels are used for different components, then security is improved, but productivity decreases due to multiple authentication steps

Engineering Contradiction:
ImprovesecurityVSAvoidauthentication speed
Core Design Contradiction:
Object-affected harmful factorsVSProductivity

Solution Approach 1:

The patent implements preliminary action by having the user authenticate once with the cloud controller before the application invocation. The cloud controller pre-validates cloud controller permissions and includes this validation result in the de-privileged token. This preliminary authentication step eliminates the need for repeated cloud controller permission validation during application execution, thereby maintaining security while improving productivity by reducing redundant authentication steps.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3394782B1Distributed validation of credentials
Publication Date: 2020.07.29 PIVOTAL SOFTWARE INC
  • EP3394782B1 patent drawingFigure 1
  • EP3394782B1 patent drawingFigure 2

AI summary

Systems, methods, and computer program products for distributed validation of credentials are described. Upon receiving a request to perform an action by a user, a system performs a multi-part authentication where in each part, only a portion of authentication information is passed. In a first stage, an application manager of the system receives a first token than specifies partial access rights. In a second stage, a cloud controller of the system requests and receives privileges of the user separately from the first token. An API is presented with a token that only contains the authorities that the API needs, while still allowing validation of cloud controller permissions without having to escalate the user's privileges.