Multi-tenant Machine Enrollment via Delegated Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Internet services face challenges in securely managing access to resources, as unauthorized users can access resources if they obtain access links or authentication credentials, lacking robust multi-tenancy capabilities to enforce proper authorization.
Innovation Solution
A multi-tenant environment securely enrolls machines using on-premise authentication mechanisms like PKI and STS, establishing trust relationships to validate tokens and authorize access, allowing each tenant to customize authentication levels and protocols, ensuring that only authorized machines access resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If centralized authentication is used in multi-tenant environment, then access control is simplified, but security and flexibility are reduced
Solution Approach 1:
The authentication system is segmented into independent tenant-specific authentication services. Each tenant operates their own authentication mechanism (PKI, STS, Kerberos, etc.) rather than relying on a centralized authentication system. This segmentation allows each tenant to maintain their own security policies and authentication methods while still accessing the multi-tenant environment through their authenticated identity.
Solution Approach 2:
An identity provider acts as an intermediary between the tenant's authentication service and the multi-tenant environment. The identity provider receives authentication requests, validates them against the tenant's authentication mechanism, and returns authentication results. This intermediary enables seamless integration of diverse authentication systems without requiring centralized control.
2Ease of manufacture
If standardized authentication protocol is imposed, then integration is easier, but adaptability to different tenant requirements is reduced
Solution Approach 1:
The system implements a universal identity provider interface that can work with multiple authentication mechanisms (PKI, STS, Kerberos, and others). The identity provider is designed to be multi-functional, supporting various authentication protocols through a common interface. This allows the system to integrate with different tenant authentication systems without requiring separate integration logic for each protocol.
Solution Approach 2:
The authentication system allows dynamic configuration of authentication parameters specific to each tenant. The identity provider can adjust authentication methods, token formats, and validation rules based on tenant requirements. This parameter flexibility enables the system to adapt to different authentication mechanisms while maintaining a consistent integration approach.
3Ease of operation
If machine authentication is not enforced, then access is easier, but unauthorized access risk increases
Solution Approach 1:
Machine authentication is performed preliminarily before granting access to resources. The identity provider authenticates the machine's identity token before the machine can access any resources in the multi-tenant environment. This preliminary authentication ensures that only authorized machines can establish connections and request resources, preventing unauthorized access before it can occur.
Solution Approach 2:
The system implements feedback mechanisms where the identity provider continuously validates machine authentication tokens and monitors access patterns. Authentication status is verified for each resource request, and the system provides feedback about authorization decisions. This continuous feedback ensures that unauthorized access attempts are detected and blocked while maintaining proper access control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In a multi-tenant environment, machines across the Internet, belonging to a particular subscription are securely enrolled with the tenant's subscription. Authentication of the machines is delegated to each of the tenant's own on-premise authentication mechanism The trust relationship with the tenant's authentication service is used to validate the security token presented by the machine being authenticated. Once authenticated, the machine has authorization (e.g., SSL machine cert for identity, security token, etc.) to access the subscription. Each tenant within the multi-tenant environment can provide its own level of authentication. The machine presents the security token to the multi-tenant environment for requests for resources (e.g., services/content) from a user. When a request is received from a machine to access a resource, the multi-tenant environment determines from the issued token whether or not the machine is authorized to access the requested resources.