Anonymous Distributed Authentication via Tenant-Managed Leases
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional storage access methods require tenants to register user information with the storage provider, which can compromise user privacy and is inefficient for adding or removing users, as each change necessitates registration with the storage provider.
Innovation Solution
Implementing a method where users are authenticated using signed leases provided by their tenant organization, allowing users to access remote storage without registering with the storage provider, by using a temporary secret code included in the lease, which is cryptographically combined with the storage request to verify access permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If tenants register user information with the storage provider, then the storage provider can authenticate users, but user privacy is compromised and user management becomes inefficient
Solution Approach 1:
The patent extracts user authentication responsibility from the storage provider and transfers it to the tenant. The tenant's server generates and manages authentication tokens for its users, eliminating the need for users to register with the storage provider. This extraction resolves the contradiction by maintaining authentication reliability while improving user management efficiency, as tenants can add or remove users without involving the storage provider.
Solution Approach 2:
The patent introduces an intermediary authentication token mechanism between users and the storage provider. The tenant's server acts as an intermediary that issues tokens to users and validates them before accessing storage. This intermediary approach maintains secure authentication while allowing tenants full control over user management, resolving the contradiction between authentication reliability and operational efficiency.
2Reliability
If tenants register user information with the storage provider, then authentication can be performed, but central entity involvement in user management increases
Solution Approach 1:
The patent extracts user management complexity from the central storage provider and transfers it to the tenant's server. The tenant's server independently handles user registration, authentication token generation, and access control decisions. This extraction reduces central entity involvement while maintaining access control reliability, as the distributed architecture allows tenants to manage their own users without central intervention.
Solution Approach 2:
The patent implements self-service authentication where the tenant's server autonomously manages user access without requiring central entity involvement. The tenant's server generates authentication tokens, validates them, and controls access permissions independently. This self-service approach reduces system complexity at the central entity while maintaining secure access control.
3Ease of operation
If users sign storage requests with temporary secret codes from leases, then user privacy is maintained and user management is efficient, but authentication complexity increases
Solution Approach 1:
The patent introduces an intermediary authentication token as a mediator between the tenant and the storage provider. This token encapsulates authentication information and allows users to sign storage requests without directly exposing their identity or credentials to the storage provider. The intermediary token simplifies the authentication mechanism from the user's perspective while maintaining privacy and management efficiency.
Solution Approach 2:
The patent uses a copied authentication token approach where the tenant's server creates a temporary authentication token that contains all necessary authentication information. Users receive this token copy and use it to sign storage requests. This copying approach simplifies authentication by giving users a self-contained credential without requiring complex key management or direct involvement with the storage provider's authentication system.
Data Source
AI summary
A method performed at a central entity includes (a) sharing a secret with a remote tenant server of one of a plurality of tenant organizations, the tenant server being configured to provide authentication services for accessing storage of the central entity, (b) receiving a storage request from a remote client device, (c) extracting an identification of the tenant organization from a core portion of the request, (d) selecting the shared secret of the identified tenant organization, (e) cryptographically combining the core portion and the shared secret to generate a preliminary signature, (f) performing a computation using the preliminary signature and a body portion of the request to generate a test signature, the body portion including the core portion and an object identifier, (g) comparing the test signature with a signature from the request, and (h) permitting the client device to access an identified object only when the comparison is positive.