Authentication Delegation via TLS Handshake Re-verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems face challenges in securely delegating user authentication across a chain of entities without relying on a trusted third-party entity or Key Distribution Center, particularly in scenarios where the gateway is not initially provided with user credentials, which can compromise security if the gateway is compromised.
Innovation Solution
The proposed solution involves recording and re-verifying a portion of the TLS handshake between a user and a gateway, with the recorded cryptographic evidence being used to authenticate the user to a server or a third-party entity, which then provides credentials to the gateway for access, ensuring that the server and third-party entity make authorization decisions without being involved in the initial authentication process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the gateway is provided with user credentials for authentication delegation, then authentication can be performed, but security is compromised if the gateway is compromised
Solution Approach 1:
The authentication process is segmented into two independent parts: (1) the TLS handshake between user and gateway that establishes cryptographic credentials, and (2) the authentication delegation to the server. The gateway does not store or handle user credentials directly; instead, it presents cryptographic evidence from the TLS handshake to the server for verification, separating credential storage from authentication functionality.
Solution Approach 2:
The server acts as an intermediary that verifies the cryptographic evidence from the TLS handshake directly, without the gateway needing to possess or transmit user credentials. The server independently validates the authentication proof, eliminating the security risk of gateway-compromised credentials while enabling authentication delegation.
2Reliability
If a trusted third-party entity or Key Distribution Center is used for authentication delegation, then security is improved, but system complexity increases
Solution Approach 1:
The server performs self-verification of the TLS handshake cryptographic evidence without requiring a trusted third-party entity or Key Distribution Center. The server independently validates the authentication proof using standard TLS verification mechanisms, eliminating the need for additional trusted intermediaries and reducing system architectural complexity.
3Reliability
If the server is involved in the initial authentication between user and gateway, then authentication security is improved, but the server becomes a point of failure and system complexity increases
Solution Approach 1:
The initial authentication process is extracted from the server and performed independently between the user and gateway via TLS handshake. The server is taken out of the initial authentication chain and only receives cryptographic evidence for verification, reducing the server's involvement and potential attack surface while maintaining authentication security through independent TLS verification.
Data Source
AI summary
The method of delegating authentication, within a chain of entities, relies upon a recording of at least a portion of a TLS handshake between a gateway device and user, in which the user needs access to a desired server. The method then relies upon re-verification of cryptographic evidence in the recorded portion of the TLS handshake, which is forwarded either (1) to the server to which access is desired, in which case the server re-verifies the recorded portion to confirm authentication, or, (2) to a third party entity, in which case the third party entity confirms authentication and provides credentials to the gateway server which then uses the credentials to authenticate to the server as the user.