Transient Identity Credentials for Ephemeral Software Components
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud-based and containerized environments, providing a unique, consistent, and provable identity to software components is challenging due to the ephemeral nature of these environments, which lacks persistent storage necessary for secure identity management, and existing solutions fail to securely manage identity credentials without local storage.
Innovation Solution
A method and apparatus for dynamically managing cryptographically secure, unique identity credentials that can be created, assigned, suspended, and revoked without requiring local persistent storage, using a certificate signing request (CSR) to ensure secrets are only known to the software component, and orchestrating identity credentials across software component reconstitution, maintaining trust through group identity credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public certificates are used to provide unique identity to software components, then identity verification is enabled, but the private key cannot be shared even with the controlling engine
Solution Approach 1:
A certificate authority (CA) acts as an intermediary between the software component and the controlling engine. The CA issues certificates that bind public keys to component identities, enabling verification without sharing private keys. The controlling engine can verify component identities through certificate validation while the private keys remain securely isolated within each component instance.
2Reliability
If persistent storage is used to store identity credentials locally, then secure identity management is achieved, but cloud-based and containerized environments cannot be used
Solution Approach 1:
The identity credential storage function is extracted from the software component instance and relocated to an external, distributed storage system. Identity credentials are stored in an identity repository accessible via network protocols, allowing components in ephemeral cloud and containerized environments to retrieve and use their credentials without local persistent storage.
Solution Approach 2:
An identity management service acts as an intermediary between software components and the storage system. This service handles credential retrieval, validation, and management operations, enabling secure identity management in environments where components lack local persistent storage while maintaining control over credential access.
3Productivity
If software components are relaunched with modified code bases in containerized environments, then service capacity is optimized, but consistent identity provision becomes difficult
Solution Approach 1:
Identity credentials are pre-configured and registered in the identity repository before software components are deployed or relaunched. When components are relaunched with modified code bases, the identity management system can retrieve their pre-existing credentials to maintain consistent identities across relaunches, ensuring continuity of trust relationships.
Solution Approach 2:
The identity management system implements feedback mechanisms to track and verify component identities across relaunches. The system monitors component launches, retrieves appropriate credentials from the repository, and validates identity consistency, providing feedback to ensure that relaunched components maintain their intended identities despite code modifications.
Data Source
AI summary
One or more computing devices employs a method that includes requesting a transient credential (e.g., a one-time PKI certificate) as a first identity credential for an application component instance based on a unique identifier associated with the application component instance. The method includes requesting a dynamically-created second identity credential for the application component instance of the application using a request signed (e.g., using the public key of the first identity PKI certificate) based on the transient credential. The method includes receiving the dynamically-created second identity credential and using the dynamically-created second identity credential in a cryptographic function by the application component instance; and managing the replacement of this credential in environments without persistent archival storage accessible by the device/application.