Device authentication within deployable computing environment
A deployable computing environment may facilitate interaction and data sharing between users and devices. Users, devices, and relationships between the users and devices may be represented within the deployable computing environment. A relationship between a user and a device may specify that the device is owned by the user and that the device is authorized to perform operations within the deployable computing environment on behalf of the user. Secure authentication of devices and users for interaction within the deployable computing environment is achieved by authenticating tickets corresponding to the user, the device, and the relationship. A device identification ticket and a user identification ticket are used to authenticate the device and user for interaction within the deployable computing environment. A device claim ticket allows the device to perform delegated operations (e.g., data synchronization, peer connectivity, etc.) on behalf of the user without the user's credentials (e.g., user identification ticket).
1. A method for managing relationships in a deployable computing environment, comprising:
creating an identity resource representing a user within a deployable computing environment, the identity resource corresponding to a user identification ticket used to authorize the user to perform one or more user operations;
creating a device resource representing a device within the deployable computing environment, the device resource corresponding to a device identification ticket used to authorize the device to perform one or more device operations; and
creating a device claim resource representing a relationship between the user and the device, the device claim resource corresponding to a device claim ticket used to authorize the device to perform an authorized user operation on behalf of the user regardless of whether the user has authorized user operation via the user identification ticket, the authorized user operation not comprising the one or more device operations that the device is authorized to perform,
at least some of at least one of the creating an identity resource, the creating a device resource, or the creating a device claim resource implemented at least in part via a processing unit.
2. The method of claim 1 , comprising
receiving the user identification ticket from the user on a first device; and
authorizing the user to perform a user operation based upon authentication of the user identification ticket.
3. The method of claim 1 , comprising:
receiving the device identification ticket from the device; and
authorizing the device to perform a device operation based upon authentication of the device identification ticket.
4. The method of claim 3 , comprising:
restricting the device from performing a user operation on behalf of the user based upon the user not authorizing user operation via the user identification ticket.
5. The method of claim 1 , comprising:
receiving the device claim ticket from the device; and
authorizing the device to perform the authorized user operation on behalf of the user based upon authentication of the device claim ticket.
6. The method of claim 5 , the authorizing comprising:
authorizing the device to perform the authorized user operation on behalf of the user when the user has not obtained authorization through the device using the user identification ticket.
7. The method of claim 1 , comprising:
terminating the device claim resource to restrict the device from performing the authorized user operation on behalf of the user.
8. The method of claim 1 , the authorized user operation comprising at least one of a user resource enumeration, a user property modification, or a user resource modification.
9. The method of claim 1 , a device operation comprising a resource synchronization operation between a resource within the device and a corresponding resource within the deployable computing environment.
10. The method of claim 1 , comprising:
receiving the device claim ticket from the device; and
authorizing the device to access a second device on behalf of the user as the authorized user operation based upon authentication of the device claim ticket, the second device having a relationship with the user that is represented by a second device claim resource within the deployable computing environment.
11. A system for managing relationships in a deployable computing environment, comprising:
an authenticator component configured to:
create an identity resource representing a user within a deployable computing environment, the identity resource corresponding to a user identification ticket used to authorize the user to perform one or more user operations;
create a device resource representing a device within the deployable computing environment, the device resource corresponding to a device identification ticket used to authorize the device to perform one or more device operations; and
create a device claim resource representing a relationship between the user and the device, the device claim resource corresponding to a device claim ticket used to authorize the device to perform an authorized user operation on behalf of the user regardless of whether the user has authorized user operation via the user identification ticket, the authorized user operation not comprising the one or more device operations that the device is authorized to perform,
at least some of the authenticator component implemented at least in part via a processing unit.
12. The system of claim 11 , the authenticator component configured to:
receive the device claim ticket from the device; and
authorize the device to perform the authorized user operation on behalf of the user based upon authentication of the device claim ticket.
13. The system of claim 11 , the authenticator component configured to:
receive the device claim ticket from the device; and
authorize the device to access a second device on behalf of the user as the authorized user operation based upon authentication of the device claim ticket, the second device having a relationship with the user that is represented by a second device claim resource within the deployable computing environment.
14. The system of claim 11 , the authenticator component configured to:
receive the user identification ticket from the user on a first device; and
authorize the user to perform a user operation based upon authentication of the user identification ticket.
15. The system of claim 12 , the authenticator component configured to:
authorize the device to perform the authorized user operation on behalf of the user when the user has not obtained authorization through the device using the user identification ticket.
16. The system of claim 11 , the authenticator component configured:
terminate the device claim resource to restrict the device from performing the authorized user operation on behalf of the user.
17. A tangible computer-readable storage medium comprising computer-executable instructions, which when executed at least in part via a processing unit on a computer performs acts, comprising:
creating an identity resource representing a user within a deployable computing environment, the identity resource corresponding to a user identification ticket used to authorize the user to perform one or more user operations;
creating a device resource representing a device within the deployable computing environment, the device resource corresponding to a device identification ticket used to authorize the device to perform one or more device operations; and
creating a device claim resource representing a relationship between the user and the device, the device claim resource corresponding to a device claim ticket used to authorize the device to perform an authorized user operation on behalf of the user regardless of whether the user has authorized user operation via the user identification ticket, the authorized user operation not comprising the one or more device operations that the device is authorized to perform.
18. The tangible computer-readable storage medium of claim 17 , comprising:
receiving the device claim ticket from the device; and
authorizing the device to perform the authorized user operation on behalf of the user based upon authentication of the device claim ticket.
19. The tangible computer-readable storage medium of claim 18 , comprising:
authorizing the device to perform the authorized user operation on behalf of the user when the user has not obtained authorization through the device using the user identification ticket.
20. The tangible computer-readable storage medium of claim 17 , comprising:
receiving the device claim ticket from the device; and
authorizing the device to access a second device on behalf of the user as the authorized user operation based upon authentication of the device claim ticket, the second device having a relationship with the user that is represented by a second device claim resource within the deployable computing environment.