Identity Verification Certificate Provision via Signed Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing application access to protected resources on cloud platforms face challenges due to the need for platform-independent credentials like shared secrets or X.509 certificates, which create control and management issues.
Innovation Solution
A method involving a processor that generates and transmits signed tokens using private keys, without sharing these keys, to facilitate secure verification and access to protected resources through Active Directory Federation Services (ADFS), utilizing JSON Web Tokens (JWT) for identity verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shared secrets, passwords, or X.509 certificates are used as credentials for application authentication on cloud platforms, then the application can verify its identity, but the application must store these security credentials which creates control and management problems
Solution Approach 1:
The patent extracts the security credential (private key) from the application entirely. Instead of storing credentials in the application, the system uses a credential manager service that holds the private key securely. The application only receives signed tokens that prove identity without containing the actual credential, thus solving the storage and management problem while maintaining verification reliability.
Solution Approach 2:
The patent introduces a credential manager service as an intermediary between the application and the authentication system. This mediator securely stores the private key, generates signed tokens, and transmits them to the application. The application never directly handles or stores sensitive credentials, eliminating management complexity while ensuring reliable identity verification through the intermediary's signed tokens.
2Adaptability or versatility
If platform-independent credentials are used for deployment to multiple cloud platforms, then the application can access both internal and external platforms, but control and management of these credentials becomes impractical
Solution Approach 1:
The patent implements a universal credential management system where a single credential manager service can issue tokens valid across multiple platforms (internal and external cloud platforms). The signed tokens follow standard formats (such as JWT) that are widely accepted, providing platform independence. The credential manager handles all platform-specific authentication protocols, making the application portable while keeping credential management centralized and simple.
3Reliability
If the application stores security credentials like passwords, then identity verification can be performed, but security is compromised as credentials must be kept confidential in the application
Solution Approach 1:
The patent extracts the sensitive private key from the application and stores it exclusively in the credential manager service. The application receives only signed tokens that contain verification information without the actual secret. This extraction eliminates the security vulnerability of storing credentials in the application while maintaining the ability to verify identity through the signed tokens.
Solution Approach 2:
The patent creates a copy of the verification capability in the form of signed tokens. Instead of giving the application access to the original private key, the credential manager generates token copies that contain the necessary verification information. These tokens can be safely transmitted to the application without compromising the original credential's security, as the private key never leaves the credential manager.
Data Source
AI summary
A method for facilitating a provision of a certificate that securely verifies an identification of an application is provided. The method includes: validating a bootstrap identity that identifies the application at a time of invocation; generating a first token that is signed with a first private key and transmitting the signed first token to the application; receiving, from an external server, a request for a public key to be used for verifying the first private key; and transmitting the requested public key to the external server in order to prompt the external server to provide the certificate to the application. When prompted to provide the certificate to the application, the external server generates a second token that is signed with a second private key and transmits the certificate in conjunction with the signed second token to the application. The private keys are never shared with the application.