Zero-Trust Authentication With Intermediary Co-Signing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote access systems face challenges in ensuring secure access management, as they often rely on single points of trust that can be compromised, leading to unauthorized access or excessive permissions, and lack effective mechanisms for decentralized verification and authentication.
Innovation Solution
A zero trust authentication system that employs an intermediary co-signer (ICS) to validate access requests based on multiple signatures from an identity provider (IdP) and client, using a dual consent mechanism to ensure secure access without relying on encryption, maintaining an immutable log of communications, and minimizing trust in any single component.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single point of trust is used for authentication, then the authentication process is simplified, but the system becomes vulnerable to compromise and unauthorized access
Solution Approach 1:
The authentication system is segmented into multiple independent trust anchors (identity provider authority and intermediary co-signer) rather than relying on a single point of trust. Each segment performs a specific verification function, creating a distributed trust model where compromise of one segment does not invalidate the entire system.
Solution Approach 2:
An intermediary co-signer is introduced as a mediator between the client and target computing system. This intermediary verifies authentication tokens and adds its own signature, creating an additional layer of verification without requiring the client and target to directly trust each other, thus distributing trust across multiple intermediaries.
2Reliability
If decentralized verification is implemented, then system security is improved, but the authentication mechanism becomes more complex
Solution Approach 1:
The authentication token serves multiple functions: it carries the client's identity verification from the identity provider, includes an authentication nonce for replay attack prevention, and is signed by both the identity provider and the intermediary co-signer. This multi-functional design consolidates multiple security requirements into a single verification process at the target system.
Solution Approach 2:
The identity provider authority and intermediary co-signer perform verification actions in advance by signing the authentication token before it reaches the target system. This preliminary signing creates a pre-verified credential that the target system can validate without performing complex real-time verification, shifting computational complexity to the authentication phase.
3Reliability
If multiple signatures are required for access control, then unauthorized access is prevented, but the access control process becomes slower
Solution Approach 1:
Multiple signatures are applied in advance during the authentication phase rather than being verified in real-time during each access request. The identity provider and intermediary co-signer sign the token beforehand, creating a pre-authenticated credential that enables fast subsequent access decisions at the target system.
Solution Approach 2:
The authentication token is copied and forwarded between systems without requiring repeated verification of the original signatures. The target system validates the copied token's signatures once, and subsequent access requests can reference this validation, reducing repeated verification overhead and improving access control speed.
Data Source
AI summary
Systems and methods for zero trust authentication. In certain embodiments, a method may comprise providing, from a client computing system to an identity provider (IdP) authority, an authentication nonce value generated by hashing a random value and a public key of the client computing system, and receiving, at the client computing system from the IdP authority, an authorization token including the authentication nonce value, where the authorization token is signed by a private key of the IdP authority. The method may further comprise providing a message including the authorization token from the client computing system to a target computing system via an intermediary co-signer (ICS) configured to authenticate the message.