Device authentication within deployable computing environment
A deployable computing environment may facilitate interaction and data sharing between users and devices. Users, devices, and relationships between the users and devices may be represented within the deployable computing environment. A relationship between a user and a device may specify that the device is owned by the user and that the device is authorized to perform operations within the deployable computing environment on behalf of the user. Secure authentication of devices and users for interaction within the deployable computing environment is achieved by authenticating tickets corresponding to the user, the device, and the relationship. A device identification ticket and a user identification ticket are used to authenticate the device and user for interaction within the deployable computing environment. A device claim ticket allows the device to perform delegated operations (e.g., data synchronization, peer connectivity, etc.) on behalf of the user without the user's credentials (e.g., user identification ticket).
1. A computing device, comprising:
one or more processing units; and
memory storing instructions that when executed by at least one of the one or more processing units, cause the computing device to perform operations, the operations comprising:
using a device claim ticket that defines a relationship between a user and a device to authorize the device to perform a user operation on behalf of the user regardless of whether the user has authorized performance of the user operation via a user identification ticket; and
performing the user operation on behalf of the user regardless of whether the user has authorized performance of the user operation.
2. The computing device of claim 1 , wherein the user operation does not comprise one or more device operations that the device is authorized to perform.
3. The computing device of claim 1 , wherein the operations further comprise:
creating a device resource corresponding to a device identification ticket.
4. The computing device of claim 1 , wherein the device identification ticket is used to authorize the device to perform at least one device operation.
5. The computing device of claim 1 , wherein the operations further comprise:
creating an identity resource corresponding to the user identification ticket.
6. The computing device of claim 1 , wherein the operations further comprise:
authorizing the device to perform the user operation on behalf of the user when the user has not provided authorization through the device using the user identification ticket.
7. A method, comprising:
receiving a request to perform a first user operation of one or more user operations, the request comprising a device claim ticket, the device claim ticket asserting an existence of a relationship between a user and the device, and providing permission for the device to perform the one or more user operations on behalf of the user;
determining, responsive to the request, whether the relationship between the user and the device has been cancelled; and
selectively authorizing the device to perform the first user operation by:
authorizing the device to perform the first user operation on behalf of the user in response to a determination that the relationship between the user and the device has not been cancelled, wherein the device is not authorized to perform the first user operation on behalf of the user if it is determined that the relationship between the user and the device has been cancelled.
8. The method of claim 7 , wherein authorizing the device to perform the first user operation includes using the device claim ticket to authorize the device to perform the first user operation on behalf of the user regardless of whether the user has authorized performance of the first user operation via a user identification ticket.
9. The method of claim 8 , the method further comprising:
receiving the user identification ticket from the user; and
authorizing the user to perform a second user operation based upon the user identification ticket.
10. The method of claim 8 , wherein authorizing the device to perform the first user operation on behalf of the user includes authorizing the device to perform the first user operation when the user has not provided authorization through the device using the user identification ticket.
11. The method of claim 7 , the method further comprising:
creating a device resource corresponding to a device identification ticket.
12. The method of claim 11 , wherein the device identification ticket is used to authorize the device to perform at least one device operation.
13. The method of claim 11 , the method further comprising:
receiving the device identification ticket from the device; and
authorizing the device to perform a device operation based upon the device identification ticket.
14. A computing device, comprising:
one or more processors; and
memory storing instructions that when executed by at least one of the one or more processors, cause the computing device to perform operations, the operations comprising:
transmitting a request to perform a first user operation, the request comprising a device claim ticket, the device claim ticket asserting an existence of a relationship between a user and a device, and providing permission for the device to perform the first user operation on behalf of the user;
receiving, in response to the request, a reply that verifies that the relationship between the user and the device remains valid; and
in response to the reply, performing the first user operation on behalf of the user.
15. The computing device of claim 14 , wherein performing the first user operation includes performing the first user operation on behalf of the user regardless of whether the user has authorized performance of the first user operation.
16. The computing device of claim 14 , wherein the operations further comprise:
creating a device resource corresponding to a device identification ticket.
17. The computing device of claim 16 , wherein the device identification ticket is used to authorize the device to perform at least one device operation.
18. The computing device of claim 14 , wherein the operations further comprise:
receiving a user identification ticket; and
performing a second user operation based upon the user identification ticket.
19. The computing device of claim 18 , wherein the second user operation includes creating an identity resource corresponding to the user identification ticket.
20. The computing device of claim 14 , wherein the operations further comprise:
receiving a device identification ticket; and
performing a device operation based upon the device identification ticket.