Dynamic Security Token Provisioning for Cloud Virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based virtualization platforms face challenges in securing virtual systems due to the risk of predetermined secrets being compromised, especially in distributed environments where a single security threat can pose a risk to the entire system, and existing authentication methods are not feasible in virtualized platforms.
Innovation Solution
A method for providing a security token to cloud-based assets on demand, which involves receiving a prompt from the asset seeking access to a controlled resource, extracting information from a trusted cloud platform resource, authenticating the asset, generating a unique security token, and making it available to the asset, ensuring only authorized instances can access target assets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If predetermined secrets are hard-coded into applications for authentication, then application authentication capability is provided, but security is worsened because secrets can be easily discovered and compromised
Solution Approach 1:
The patent extracts the authentication secret from the application itself and places it in a separate, secure location managed by the cloud platform. The application no longer contains its own secret but instead receives authentication tokens from the cloud platform, eliminating the risk of hard-coded secrets while maintaining authentication capability.
Solution Approach 2:
The cloud platform acts as an intermediary between the application and the authentication system. Instead of applications having direct access to secrets, the cloud platform mediates by issuing tokens that applications use for authentication, separating the authentication logic from the application code.
2Stability of the object's composition
If predetermined secrets are shared among distributed applications, then authentication consistency is achieved, but security is worsened because a compromised secret affects the entire system
Solution Approach 1:
The patent segments authentication credentials by creating unique tokens for each application instance rather than using shared secrets. Each application receives its own authenticated token from the cloud platform, so a compromise in one instance does not affect others, while the cloud platform maintains consistency across all instances.
3Reliability
If host OS queries are used to verify application authenticity, then authentication verification is provided, but feasibility is worsened in virtualized environments where OS isolation prevents access
Solution Approach 1:
The cloud platform serves as an intermediary that knows both the application identity and the host OS information. Instead of requiring the application to query the host OS (which is blocked by isolation), the cloud platform mediates by providing authentication tokens based on information it already possesses about the application and its hosting environment.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
The disclosed embodiments include systems and methods for providing security tokens to cloud-based assets on demand. Operations performed in the disclosed embodiments include receiving (202) a prompt from a cloud-based asset indicating that the cloud-based asset (108) is seeking to communicate with an access-controlled resource, wherein the cloud-based asset lacks authorization to communicate with the access-controlled resource. Additionally, the operations include extracting (204) information associated with the cloud-based asset by accessing a trusted cloud platform resource (104) storing data associated with verified cloud-based assets, where the trusted cloud platform resource is separate from the cloud-based asset, and authenticating (206) the cloud-based asset based on the extracted information. The operations also include generating (208) a security token for the cloud-based asset, making a first portion (300) of the security token available to be injected into the cloud-based asset, and responding to the prompt with a second portion (400) of the security token.