Hybrid Cloud Trust Protocol Using Segmented Secrets

Solution Overview

Problem

Existing cybersecurity approaches in hybrid cloud environments face challenges in establishing strong, mutual trust relationships due to reliance on single points of weakness and lack of continuous validation, particularly in scenarios where internal trust is not assumed.

Innovation Solution

A seven-step trust establishing protocol that involves continuous monitoring and validation of integrity and trust policy compliance, using two separate pieces of trust establishing materials to ensure mutual trust and security, with mechanisms like HMAC signature validation to prevent tampering and unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional cybersecurity approaches are used in hybrid cloud environments, then implementation is simpler, but security strength is weakened due to single points of weakness and lack of continuous validation

Engineering Contradiction:

Improvetrust relationship strengthVSAvoidprotocol complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The trust establishing materials are divided into two separate parts: a trust certificate and a secret. These segmented components are distributed through different pathways and stored separately, eliminating single points of weakness while maintaining manageable complexity through structured organization

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary validation of the trust certificate and secret before establishing the trust relationship. Integrity checks and validation operations are executed in advance to ensure security compliance before actual communication begins

Inventive Principle:

Principle #10Preliminary action

Solution Approach 3:

The system implements continuous monitoring and validation feedback mechanisms that verify trust policy compliance throughout the communication process. This ongoing feedback ensures maintained security without requiring complete protocol redesign

Inventive Principle:

Principle #23Feedback

2Reliability

If trust establishing materials are distributed through single pathways, then distribution is simpler, but security is weakened due to potential compromise points

Engineering Contradiction:

Improvesecurity strengthVSAvoiddistribution complexity

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The trust establishing materials are divided into two separate parts: a trust certificate and a secret. These segmented components are distributed through different pathways and stored separately, eliminating single points of weakness while maintaining manageable complexity through structured organization

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The cloud management platform acts as an intermediary that coordinates the distribution of trust establishing materials through multiple pathways. This intermediary manages the complexity of multi-path distribution while ensuring secure delivery to the endpoint

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If internal trust is assumed in hybrid cloud environments, then operations are simpler, but security protection is reduced against internal threats

Engineering Contradiction:

Improvesecurity protectionVSAvoidvalidation mechanism complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system applies preliminary validation checks to verify the integrity of trust establishing materials before accepting them as trustworthy. This preliminary anti-action prevents potential internal threats by validating authenticity before trust is established

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The system performs preliminary validation of the trust certificate and secret before establishing the trust relationship. Integrity checks and validation operations are executed in advance to ensure security compliance before actual communication begins

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12063316B2Establishing a trust relationship in a hybrid cloud management and management service environment

Publication Date: 2024.08.13 DELL PROD LP

AI summary

A system can receive, by a cloud management platform, a request from a user account for a trust certificate. The system can provide, to the user account via a first pathway, the trust certificate, comprising a first portion of a secret. The system can provide, to the user account via a second pathway, a second portion of the secret. The system can receive, at an on-premises cloud controller (OPCC), data indicative of the first and second portions. The system can, in response to the OPCC validating the first secret, receive, by the cloud management platform and from the OPCC, a second request to instantiate a trust relationship, wherein the second request comprises a first message body that is signed and encrypted with the first secret. The system can send, by the cloud management platform and to the OPCC, a message that comprises a second trust certificate and a second secret.