Multi-Cloud Authentication via Cross-Cloud Signature Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in securely accessing sensitive data in public cloud environments due to concerns about external and internal threats, necessitating improved data protection techniques.
Innovation Solution
A method involving a first authentication entity in a private cloud environment verifying the signature of a service from a public cloud environment through a second authentication entity, allowing data access only if the signature is verified, and optionally encrypting and decrypting the data using encryption keys from the second cloud environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored in a public cloud environment, then data accessibility and convenience are improved, but data security and protection from threats worsen
Solution Approach 1:
The patent introduces an intermediary authentication entity that mediates between the public cloud service and the data storage location. This intermediary verifies service identities through cryptographic signatures and coordinates cross-cloud authentication, allowing data to remain accessible in the public cloud while adding a security layer that prevents unauthorized access from both external and internal threats
2Device complexity
If traditional data protection functions are used in a single cloud environment, then implementation simplicity is improved, but protection against internal and external threats worsens
Solution Approach 1:
The patent segments the authentication process into distinct components: a first authentication entity in the public cloud that verifies service signatures, a second authentication entity in the private cloud that validates credentials, and cryptographic signature verification mechanisms. This segmentation distributes security responsibilities across multiple independent verification points, preventing any single point of failure or compromise from undermining overall security
Solution Approach 2:
The patent implements nested authentication where a service deployed in a public cloud must be authenticated by both the public cloud's authentication entity and a separate private cloud's authentication entity. The authentication processes are nested within each other, with the service signature verified by the first authentication entity, which then coordinates with the second authentication entity for final authorization, creating layers of verification like nested dolls
Data Source
AI summary
Techniques are provided for multi-cloud authentication of data requests. One method comprises obtaining, by a first authentication entity of a first cloud environment, from a service on the first cloud environment, a request for data stored by a second cloud environment; determining a signature for the service; verifying the determined signature for the service by requesting a signature for the service registered with a second authentication entity of the second cloud environment; requesting the data from the second authentication entity of the second cloud environment in response to the determined signature being verified; and providing the requested data to the service. The requested data from the second cloud environment may be encrypted with an encryption key, and the method may further comprise decrypting the requested data with a decryption key obtained from the second cloud environment. The signature for the service may be registered as part of a deployment of the service.