Tenant-Aware mTLS Authentication for Multi-Tenant Cloud
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud platform authentication methods, such as usernames and passwords, are prone to user errors and do not provide secure access to multi-tenant systems, especially when client devices are involved, as issuing certificates to client devices complicates the implementation of mutual Transport Layer Security (mTLS) authentication.
Innovation Solution
Implementing a tenant-aware mTLS authentication system where client devices are configured with certificates issued or provisioned by a tenant's certificate authority, allowing for secure access to services by validating digital certificates through a digital handshake with an mTLS service, reducing user interaction and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mTLS authentication with client certificates is implemented, then security is improved, but device complexity and ease of operation deteriorate due to certificate management requirements
Solution Approach 1:
The patent introduces an intermediary authentication service that handles certificate validation and authentication on behalf of the cloud platform. This mediator service receives client certificates, validates them against tenant-specific criteria, and returns authentication results, thereby eliminating the need for clients to directly manage complex certificate operations while maintaining high security through mTLS authentication
Solution Approach 2:
The authentication service enables self-service authentication where clients automatically present their certificates and receive authentication decisions without manual intervention. The system automatically validates certificates, checks tenant associations, and grants or denies access based on pre-configured policies, eliminating the need for users to manually manage certificate operations
2Reliability
If tenant-specific certificate validation is implemented, then security and authentication accuracy are improved, but system complexity increases
Solution Approach 1:
The authentication system is segmented into independent functional modules: a client certificate presentation component, a tenant association verification component, a validation criteria evaluation component, and an authentication decision component. Each module handles a specific aspect of authentication independently, allowing the complex tenant-aware validation process to be broken down into manageable steps that can be implemented and maintained more easily
Solution Approach 2:
The system performs preliminary actions by pre-establishing tenant associations with authentication services and pre-configuring validation criteria before actual authentication occurs. Tenant information and validation rules are prepared in advance, so during authentication the system only needs to retrieve and apply pre-processed data, significantly reducing the complexity of real-time validation operations
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A service may leverage a mutual transport layer security (mTLS) service to authenticate a client that is configured with a client certificate chain. The client may request access to the service, and the service may transmit a redirection response to the client. The redirection response may indicate an endpoint for the mTLS service that is associated with the tenant. In response to receiving the redirection response, the client may perform a digital handshake with the mTLS service, and the mTLS service may validate the client digital certificate and digitally sign the client digital certificate. The mTLS may transmit a redirection response, which redirects the client to the service where the client presents an indication of the digitally signed digital certificate chain. The service may validate the chain of trust associated with the digitally signed digital certificate chain and issue an indication that the client is authenticated to access the service.