Tenant-Specific Cloud Partitions for Token-Based Trusted Deployment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for deploying software components in public clouds face challenges in providing secure, automated deployment and trust establishment without manual intervention, especially in multi-tenant environments, due to vulnerabilities in hard-coded credentials and the need for user intervention.
Innovation Solution
The use of component- and tenant-specific tokens for establishing mutual trust relationships between executable software components, including single-use and time-limited tokens, ensures secure and automated deployment and interaction within the same security domain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If hard-coded username/password credentials are used for authentication, then automated deployment is enabled, but security vulnerability increases
Solution Approach 1:
The patent implements single-use tokens that are valid for only one authentication operation and then become invalid. This disposable approach replaces permanent hard-coded credentials with temporary, one-time-use authentication tokens, enabling automated deployment while eliminating the security vulnerability of reusable credentials.
Solution Approach 2:
The patent changes the authentication parameter from static username/password pairs to dynamic tokens with specific validity parameters (single-use flag, expiration time). This parameter transformation allows automated authentication processes while incorporating security constraints that prevent credential compromise.
2Object-affected harmful factors
If user interface interrogation is used for authentication, then security level is improved, but automated deployment is prevented
Solution Approach 1:
The patent implements self-service authentication where software components automatically obtain and use tokens without human intervention. The authentication system serves itself by programmatically requesting tokens from the token service and using them for deployment, combining automated deployment with secure authentication.
Solution Approach 2:
The patent introduces a token service as an intermediary between the authentication authority and the deploying software. This mediator issuestokens that represent verified credentials, allowing automated processes to authenticate securely without direct human involvement while maintaining the security benefits of credential verification.
3Reliability
If manual credential provision is required, then security control is maintained, but deployment efficiency decreases
Solution Approach 1:
The patent performs preliminary authentication by obtaining tokens before deployment operations begin. The token service pre-issues tokens with appropriate permissions and validity periods, allowing subsequent automated deployment operations to proceed efficiently without repeated manual security approvals.
Solution Approach 2:
The patent implements feedback mechanisms where the token service monitors token usage and automatically manages credential validity. The system receives feedback about deployment status and token consumption, automatically issuing new tokens or revoking old ones, maintaining security control while enabling continuous efficient deployment.
Data Source
AI summary
Methods, systems, and computer program products for executing trusted software components in public computing clouds. Verifiably authentic software components are installed into a tenant partition of a multi-tenant public cloud-based environment. To do so, a software component installer is configured to install registered software components into the tenant partition. Installer processing includes (1) obtaining a component-specific token for a software component wherein the component-specific token is specific to both the software component to be installed and a particular tenant, and (2) installing the software component on behalf of the given tenant in the multi-tenant public cloud-based environment. Prior to executing the underlying code of the tenant-specific software component, the software component is authenticated with a component registry using the component-specific token. Additional trusted components are installed based on demand from within the tenant partition. No user or administrator intervention is needed and no credentials are hard-coded into the software components.