Stateless Certificate Validation for Cloud Access Credential Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing systems face challenges in efficiently provisioning access credentials for network entities due to the need for storing and managing session state information for each network entity accessing cloud resources, which increases administrative complexity and resource overhead.
Innovation Solution
A stateless validation protocol using digital certificates is employed to authorize access credentials, where session state information is included in the digital certificates, allowing the target service to validate requests without storing public keys, and periodic rotation of asymmetric key pairs and certificates is implemented to maintain security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If session state information is stored for each network entity to enable authentication, then authentication reliability is improved, but device complexity and resource overhead increase
Solution Approach 1:
The patent extracts the session state information from the service control plane and embeds it directly into the digital certificate. This allows the service to validate credentials without storing any session state information, as all necessary validation data is contained within the certificate itself. The public key and identification information are extracted from separate storage and included in the certificate structure.
Solution Approach 2:
The digital certificate becomes self-contained with all necessary validation information embedded within it. The certificate carries its own session state information (public key, identification), allowing it to be validated without external reference to stored data. This self-sufficient design eliminates the need for the service to maintain any state information.
2Reliability
If session state information is stored for each network entity, then authentication functionality is improved, but resource overhead increases
Solution Approach 1:
The patent extracts session state information from centralized storage and embeds it within each digital certificate. This eliminates the need for the service to store any session state information, as each certificate is self-contained with all necessary validation data. The service control plane stores no public keys or session information, reducing resource overhead to zero for credential validation.
3Measurement precision
If public keys are stored for validation, then credential verification is improved, but administrative operations increase
Solution Approach 1:
The patent extracts the public key from centralized storage and embeds it directly into the digital certificate. The service validates credentials using the public key contained within the certificate itself, eliminating the need to store or retrieve public keys from any database. This extraction approach maintains verification accuracy while eliminating administrative operations related to key management.
4Device complexity
If stateless validation is implemented, then device complexity is reduced, but security requirements increase
Solution Approach 1:
The patent performs preliminary action by embedding all necessary session state information (public key, identification) into the digital certificate before validation occurs. This pre-packaging of validation data allows the service to perform stateless validation without compromising security, as all required information is already present in the certificate. The periodic rotation of key pairs and certificates further strengthens security in the stateless model.
Data Source
AI summary
Operations of a system may include executing a provisioning process that includes provisioning a network entity with a digital certificate for use in a stateless validation protocol. After provisioning the network entity with the digital certificate, the system may include receive a credential request from the network entity that includes the digital certificate and a request for an access credential for accessing a cloud resource. In response to the credential request, the system may execute an access-authorization process with respect to the network entity, including authenticating the digital certificate in accordance with the stateless validation protocol. Upon determining that the network entity authorized to receive an access credential, the system may provision the network entity with the access credential. The network entity may then use the access credential to access the cloud resource.