Persistent Operation Authentication via WebAuthn Signed Certificates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information handling systems face challenges in securely authenticating persistent operations across multiple nodes, particularly in ensuring durable and long-lived permissions for users accessing endpoints, as existing solutions lack robust mechanisms for validating declarative and imperative requests efficiently.
Innovation Solution
A multiple node environment with a control plane node, user node, endpoint node, and authenticator node uses WebAuthn (FIDO2) for secure authentication, where the authenticator device generates and verifies cryptographically signed certificates, enabling durable permissions and long-lived attestation for operations within the endpoint node.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication mechanisms are used for persistent operations, then ease of operation is maintained, but security and reliability of long-lived permissions deteriorate
Solution Approach 1:
The system performs preliminary authentication actions by generating signed authorization certificates in advance that grant permission for future operations. The control plane node receives a work order, generates a request certificate, sends it to the authenticator for signing, and stores the signed certificate for later verification, eliminating the need for repeated authentication handshakes while maintaining security.
Solution Approach 2:
The authenticator device serves as an intermediary between the control plane node and the endpoint node. It signs the request certificate generated by the control plane node, providing cryptographic verification without requiring direct trust between the control plane and endpoint nodes. This mediator approach enhances security while simplifying the overall authentication architecture.
2Reliability
If cryptographic verification is performed for each operation, then security is improved, but productivity and operation speed deteriorate
Solution Approach 1:
The cryptographic verification is performed in advance when the signed authorization certificate is generated and stored. During actual operation execution, the endpoint node simply verifies the pre-generated signed certificate rather than performing full cryptographic handshakes, significantly reducing verification time while maintaining security.
Solution Approach 2:
The system creates a copy of the authentication credentials in the form of a signed authorization certificate that can be reused for multiple operations. Instead of performing cryptographic verification for each individual operation, the system uses the pre-signed certificate copy to authenticate multiple work orders, improving productivity while maintaining security through batch cryptographic verification.
Data Source
AI summary
A control plane node of a multiple node environment includes a storage and a processor. The storage stores a signed authorization certificate. The signed authorization certificate grants permission to a user to perform an operation within an endpoint of the multiple node environment. The processor receives, from a client node, a request including a work order for the operation to be performed in the endpoint node. In response to reception of the request, the processor provides a request certificate to an authenticator device associated with an administrator of the endpoint node, and receives a signed request certificate. The processor provides the signed request certificate to the endpoint node for verification.