Key-Based Authentication for Cloud Backup Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing backup service authentication methods, such as file level restore (FLR) and granular level restore (GLR), primarily rely on password-based authentication, which is insecure, especially when cloud service providers like AWS and Azure disable password-based authentication, necessitating a secure key-based authentication solution.
Innovation Solution
A method and system for key-based authentication that involves a client device generating a signature using a private key, requesting and verifying a public key from a server, and generating a token encrypted with the public key to enable access to the backup service without requiring a password, ensuring secure authentication through Transport Layer Security (TLS) protocol.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password-based authentication is used for FLR/GLR service, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent changes the authentication parameter from password-based to public key-based authentication. The server retrieves the user's public key from cloud storage and uses it for authentication, eliminating the need for password transmission while maintaining ease of operation through automated key management
Solution Approach 2:
The patent introduces cloud storage as an intermediary to store the user's public key. Instead of direct password verification between client and server, the system uses the intermediary cloud storage to provide the public key, enabling secure authentication without exposing sensitive credentials
2Reliability
If key-based authentication is implemented, then security is improved, but device complexity is worsened
Solution Approach 1:
The system implements self-service authentication where the server automatically retrieves the public key from cloud storage and performs verification without requiring complex client-side key management. The client simply needs to provide the private key path, and the server handles the rest of the authentication process
Solution Approach 2:
The patent makes the authentication system universal by supporting both password-based and public key-based authentication methods. The server can adapt to different authentication types, making the system flexible and reducing the need for separate authentication systems for different security requirements
Data Source
AI summary
A method and system for performing authentication for a backup service provided by a server is provided. The method receives a request for authentication from a client device, the request for authentication including a signature generated using a private key. The method sends a request to obtain a public key corresponding to the private key to the server and receives the public key from the server, the public key being retrieved by the server from a backup of a virtual machine. The method verifies the signature using the public key and generates a token encrypted using the public key, the token enabling the client device to access the server for the backup service. The method sends the token to the client device, the token to be decrypted using the private key by the client device.