Domain-Authenticated Platform Resource Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data-at-rest encryption technologies rely on single passwords for access control, making them vulnerable to password guessing attacks, especially in mobile and distributed computing environments where data loss and theft are more likely.
Innovation Solution
Implementing domain-authenticated control of platform resources using a method that involves obtaining and authenticating domain credentials before loading the operating system, unlocking resources with a key derived from these credentials, and using a Kerberos identity management infrastructure to manage access policies and encryption keys, ensuring secure communication and power management of resources like hard drives and flash memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If single password protection is used for data-at-rest encryption, then ease of operation is improved, but security reliability deteriorates due to vulnerability to dictionary attacks
Solution Approach 1:
The patent segments the authentication process into multiple independent components: platform credentials, user credentials, and domain controller verification. This multi-factor authentication approach divides the security mechanism into distinct layers, making it resistant to single-point failures like dictionary attacks on a single password while maintaining operational ease through automated credential management.
2Reliability
If domain-authenticated control with multiple credentials is implemented, then security reliability is improved, but device complexity increases
Solution Approach 1:
The domain controller serves as an intermediary that centralizes the complex authentication logic. Instead of embedding complex multi-credential verification in each device, the domain controller handles credential validation, policy enforcement, and key distribution. This mediator approach enhances security reliability while preventing device complexity from escalating.
Solution Approach 2:
The domain controller provides universal authentication services across multiple platforms and devices. By consolidating authentication, authorization, and encryption key management in a single multi-functional system, the patent achieves high security reliability without requiring each individual device to become complex. The domain controller handles diverse credential types and policy scenarios uniformly.
3Reliability
If encryption keys are centrally managed by domain controller, then security reliability is improved through better access control, but loss of time occurs during authentication processes
Solution Approach 1:
The system performs preliminary authentication actions by verifying platform and user credentials against the domain controller before granting access to encrypted resources. This advance verification ensures security reliability by establishing authenticated sessions beforehand, while the cached credentials and pre-established trust relationships minimize time loss during actual data access operations.
Data Source
AI summary
A method, apparatus, system, and computer program product for domain-authenticated control of platform resources. Resources under the control of the platform are managed in accordance with access control rules that are centrally managed by a directory service. Security policies are uniformly applied by requiring authorization of the user's access to platform resources including hard drives, flash memory, sensors, network controllers and power state controllers.