Secured Computing System Credential Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In secured computing architectures, the risk of unauthorized access exists due to the storage of credentials on orchestrator devices, which can compromise entire groups of agent devices if accessed, leading to potential network unauthorized access.
Innovation Solution
Agent devices poll a remote work depository for work compatible with their context, eliminating the need for orchestrator devices to store login credentials and reducing the risk of compromise by allowing authorized local agents to execute validated work requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If an orchestrator device stores credentials for logging into agent devices, then centralized control and coordination of work requests is improved, but security is worsened due to the risk of unauthorized access compromising entire groups of agent devices
Solution Approach 1:
The patent extracts the credential storage function from the orchestrator device and places it directly on each agent device. This eliminates the security vulnerability of centralized credential storage while maintaining the ability of orchestrators to assign work requests, as each agent independently validates its own credentials locally.
Solution Approach 2:
Each agent device performs self-authentication by locally validating its own credentials against a public key or certificate authority. This self-service approach eliminates the need for the orchestrator to store and manage credentials, thereby improving security while maintaining operational control.
2Productivity
If an orchestrator device mediates all client-agent interactions, then work request validation and assignment is improved, but system complexity is worsened due to the need for credential management and administrative access control
Solution Approach 1:
The patent extracts the credential validation logic from the orchestrator and implements it locally on each agent device. This reduces system complexity by eliminating the orchestrator's role as a credential management intermediary, while work request validation continues through direct client-agent interaction using locally stored credentials.
Solution Approach 2:
The patent introduces a public key or certificate authority as a trusted intermediary that agents use for self-validation. This replaces the orchestrator as the credential management intermediary, simplifying the system architecture while maintaining secure work request validation.
3Adaptability or versatility
If orchestrator devices store administrative credentials for agent devices, then remote access and control capability is improved, but the risk of malicious activity and unauthorized network access is worsened
Solution Approach 1:
The patent extracts administrative credentials from the orchestrator device and embeds them locally in each agent device. This maintains remote access capability since orchestrators can still assign work requests, but eliminates the security risk of centralized credential storage that could lead to unauthorized network access.
Solution Approach 2:
The patent implements preliminary security measures by having each agent device pre-validate its own credentials locally before accepting work requests. This preventive approach counteracts potential unauthorized access attempts by ensuring that only legitimately authenticated agents can execute work, without requiring the orchestrator to store sensitive credentials.
Data Source
AI summary
Examples related to secure computing systems are disclosed. In one example, a method includes, at a local agent computing device, sending to a remote work scheduling computing device a work context of the local agent computing device, the work context describing a set of work that the local agent is configured to execute, and polling a remote work depository for work compatible with the work context. The method further includes receiving a response from the remote work depository identifying a job within the work context, the job being requested by a computing device other than the remote work scheduling computing device, and executing the job.