Secondary Device Enrollment via Cryptographic Challenge
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern zero-trust architectures are vulnerable to attack vectors during device enrollment, where compromised credentials can lead to unauthorized devices being enrolled and granted access to organizational systems.
Innovation Solution
The system employs a security token with a private key stored securely on an organization-owned device and a public key transmitted to the management infrastructure. The secondary device is challenged to cryptographically sign a string using the private key, and if validated by the public key, the enrollment process proceeds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional device enrollment processes are used in zero-trust architectures, then device enrollment is simple and fast, but the system becomes vulnerable to credential compromise attacks and unauthorized device enrollment
Solution Approach 1:
The system performs preliminary actions by pre-registering organization-owned devices with the management infrastructure before actual enrollment needs arise. These pre-registered devices then act as trusted intermediaries to authenticate and authorize secondary devices, preventing credential compromise attacks by establishing a chain of trust before any enrollment occurs.
Solution Approach 2:
The patent introduces pre-registered organization-owned devices as intermediary entities between the management infrastructure and secondary devices seeking enrollment. These intermediaries verify credentials and authorize enrollments, adding a layer of security that prevents direct credential compromise attacks while maintaining a relatively simple user-facing enrollment process.
2Reliability
If cryptographic challenge-response validation is implemented for secondary device enrollment, then unauthorized device enrollment is prevented, but the enrollment process time increases
Solution Approach 1:
The system performs preliminary cryptographic setup by pre-registering organization-owned devices and establishing their public keys in the management infrastructure before actual enrollment. When secondary devices need to enroll, the pre-registered intermediaries quickly validate them using stored public keys, significantly reducing the time penalty of cryptographic validation compared to performing full key exchange during enrollment.
Data Source
AI summary
In certain aspects, methods include, responsive to receiving verification that credentials associated with an organization device (OD) is authenticated, requesting the OD to create a token comprising a private and public key. The method includes receiving, subsequent to the OD initiating creation of the token, the public key from the OD. The method includes associating the public key with an UPN of the OD, and includes requesting the organization credentials from a secondary device (SD), responsive to detecting a request therefrom. The method includes requesting, responsive to authentication of the organization credentials, a challenge response from the SD. The method includes receiving the challenge response from the SD, which signed the challenge response with the private key that was transferred via the OD. The method includes determining, with the public key, whether the challenge response is valid, and includes validating enrollment of the SD when the challenge response is validated.