Scoped Application Access via Embedded Public Key Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack a granular control mechanism for access to application data and APIs within a computing environment, leading to insecure access scenarios where scoped applications may inadvertently share resources with untrusted applications.
Innovation Solution
A system that uses a public key embedded in a scoped application to authenticate and verify a signed identifier from a trusted application, allowing secure access to the scoped application's interface while maintaining secure access control without pre-configuring trusted applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If scoped applications share resources in a computing environment, then resource utilization and collaboration between applications are improved, but security and access control are worsened due to lack of granular control mechanisms
Solution Approach 1:
The patent segments access control by introducing scoped applications with defined interfaces and data access boundaries. Each scoped application is divided into accessible resources that can be individually controlled through authentication mechanisms, allowing selective sharing while maintaining security boundaries.
Solution Approach 2:
The patent introduces an intermediary authentication system that mediates between trusted applications and scoped applications. This intermediary layer verifies signed identifiers and manages access permissions, enabling secure resource sharing without direct exposure between applications.
2Reliability
If pre-configuration of trusted applications is implemented, then access control security is improved, but system complexity and deployment time are worsened
Solution Approach 1:
The patent implements self-service authentication where scoped applications automatically verify signed identifiers from trusted applications using embedded public keys. This eliminates the need for manual pre-configuration of trust relationships, as the authentication mechanism is inherently built into the application architecture.
Solution Approach 2:
The patent changes the authentication parameter from static pre-configured trust lists to dynamic signed identifier verification. This allows the system to maintain security through cryptographic verification while avoiding the complexity of manually configuring and maintaining trust relationships.
3Reliability
If pre-configuration of trusted applications is required, then access security is improved, but ease of deployment and flexibility are worsened
Solution Approach 1:
The authentication system operates autonomously by automatically verifying signed identifiers against embedded public keys without requiring manual intervention for trust configuration. This self-service mechanism maintains security while dramatically simplifying deployment procedures.
Solution Approach 2:
The public key is embedded in the scoped application during the application creation phase, preparing the authentication mechanism in advance. This preliminary action ensures security is built-in from the start without requiring subsequent configuration steps during deployment.
Data Source
AI summary
A public key embedded in a scoped application can be used to permit a trusted application to access a scoped application. The scoped application can receive a request for access to an interface of the scoped application from the trusted application. The request can include a signed identifier that is signed using a private key corresponding to the public key. The signed identifier can be authenticated using the public key. The scoped application can also verify that the signed identifier matches an identifier of the trusted application. Responsive to the authentication and verification, the trusted application may be permitted to have access to the interface of the scoped application. The private key and the public key are generated at a customer service instance operated by a computing provider. The private key is not shared outside of the customer service instance.