Secure Instance Metadata Using Local Cryptographic Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud service providers face significant network traffic and potential outages due to centralized identity verification of compute instances, which is inefficient and vulnerable to downtime.
Innovation Solution
Decentralize identity verification by using a public/private key pair to digitally sign metadata associated with compute instances, storing it on the computing device, and verifying it locally using the public key, reducing the need for frequent calls to a centralized service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized identity verification is used for compute instances, then authentication can be provided to cloud resources, but network traffic increases and system vulnerability to outages increases
Solution Approach 1:
The patent segments the centralized identity verification process by distributing cryptographic verification capabilities to edge devices. Instead of one centralized service handling all verification, multiple edge devices independently verify instance identities using distributed ledger technology, reducing network traffic to the central service and improving system robustness.
Solution Approach 2:
The patent introduces a distributed ledger as an intermediary between compute instances and cloud resources. The ledger stores cryptographic identities and verification records, allowing edge devices to perform local verification without continuously querying the centralized service, thereby reducing network traffic while maintaining reliable authentication.
2Reliability
If centralized metadata service is used for instance verification, then authentication is enabled, but service downtime can occur
Solution Approach 1:
The patent enables edge devices to perform local verification of compute instance identities using cryptographic proofs stored in the distributed ledger. This local verification capability eliminates the single point of failure represented by the centralized metadata service, ensuring service availability even when the central service is down.
Solution Approach 2:
The patent performs preliminary actions by pre-storing cryptographic identities and verification records in the distributed ledger before verification is needed. Edge devices can immediately verify instance identities using pre-cached cryptographic data from the ledger, avoiding real-time dependencies on the centralized service and preventing downtime.
3Measurement precision
If frequent calls are made to centralized service for verification, then authentication accuracy is maintained, but network traffic and response time worsen
Solution Approach 1:
The patent performs preliminary actions by pre-computing and storing cryptographic verification data in the distributed ledger before authentication is needed. Edge devices can immediately verify instance identities using pre-cached cryptographic proofs, maintaining authentication accuracy while eliminating the time delay associated with frequent centralized service calls.
Data Source
AI summary
A method may include transmitting a request for metadata associated with a compute instance and receiving, by a computing system, metadata associated with the compute instance signed with a private key. The private key may be associated with a public key. The method may include receiving a request to access a cloud resource and transmitting the request for the metadata. The method may also include receiving the metadata. The metadata may indicate that the compute instance is hosted on the computing system. The method may also include transmitting, to an instance principal service, a request for an instance principal certificate. The request may include the metadata signed with the private key and be cryptographically verified by the instance principal service using the public key. The method may also include receiving the instance principal certificate and providing access to the could resource based on the instance principal certificate.