Short-Term Token Authentication for Backup Clients
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data backup systems face security vulnerabilities due to the need for user credentials to be propagated and managed across backup clients, servers, and storage devices, leading to cumbersome re-certification and potential security risks.
Innovation Solution
Implementing a token-based authentication system using short-term tokens, such as JSON Web Tokens (JWT), which eliminates the need for traditional credentials and relies on public/private key pairs for secure client authentication, ensuring only authorized access to data storage systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional credential-based authentication is used, then client authentication can be established, but security vulnerabilities arise due to credential propagation and management across backup clients, servers, and storage devices
Solution Approach 1:
The patent extracts the authentication mechanism from traditional credential-based systems and replaces it with token-based authentication. The backup server generates short-term tokens that are passed to backup clients, eliminating the need for credential propagation across the system. This extraction of the authentication mechanism from credential management resolves the security vulnerability while maintaining authentication reliability.
Solution Approach 2:
The patent introduces tokens as an intermediary element between the backup server and backup clients. Instead of directly sharing credentials, the server issues tokens that mediate the authentication process. These tokens serve as temporary credentials that can be safely transmitted and used for authentication without exposing long-term security credentials, thus eliminating credential propagation risks.
2Ease of operation
If user credentials are propagated to backup clients, then authentication is enabled, but infrastructure overhead increases due to credential management and synchronization requirements
Solution Approach 1:
The patent employs short-term tokens that are disposable and have limited validity periods. These tokens are generated by the backup server and passed to backup clients for authentication. After use or expiration, the tokens are discarded and new tokens are generated. This approach eliminates the need for long-term credential management and synchronization, significantly reducing infrastructure overhead while maintaining ease of operation.
3Adaptability or versatility
If storage system users are created for backup client authentication, then access control is established, but security vulnerabilities increase due to required login privileges and credential changes
Solution Approach 1:
The patent segments the authentication mechanism into token-based authentication rather than using traditional user account systems. Instead of creating storage system users with login privileges for each backup client, the system issues targeted tokens that provide specific access permissions. This segmentation eliminates the need for comprehensive privilege management and associated security vulnerabilities while maintaining flexible access control.
Data Source
AI summary
Embodiments for a system and method for secure authentication of backup clients in a way that eliminates the need to create users for backup client authentication anywhere in the backup ecosystem, and which eliminates the need for credentials, such as passwords that need protection, updating and synchronization. Such embodiments use a short-term token, such as a JSON web token, for both client and server authentication within the system, and verifies that the tokens grant access using the public key corresponding to the private key assigned to the directory objects by the creator of the directory objects.