Machine-to-machine streaming authentication of network elements
A system for providing dynamic, multi-factor authentication for machine-to-machine connections using unique authentication streams of chained, cryptographic blocks or codes by generating and managing a root authentication stream of chained cryptographic blocks representing an enterprise. The root authentication stream may be utilized by deployed machine instances to instantiate the unique authentication streams for each of the deployed machine instances, thereby enabling secure and continuous authentication for the machine-to-machine connections.
1. A system for machine-to-machine authentication, the system comprising:
a stream generator configured to generate a root enterprise stream;
the root enterprise stream comprising enterprise stream blocks;
a deployment server configured to deploy a machine;
the deployment server being adapted to deploy the machine so as to have a respective machine authenticator;
a primer adapted to communicate with the deployment server;
the primer being further adapted to request a seed, from the stream generator, for the machine;
the stream generator being adapted to generate the seed, for the machine, based at least on at least one of the enterprise stream blocks;
the deployment server being configured to deploy the machine so that, when the machine is a deployed machine, the respective machine authenticator of the deployed machine generates a machine authentication stream;
the machine authentication stream comprising machine stream blocks; and
the respective machine authenticator of the deployed machine generating the machine authentication stream based on the seed generated by the stream generator.
2. The system of claim 1 , wherein the machine authentication stream of the deployed machine is based on a fork of the root enterprise stream.
3. The system of claim 2 , wherein the fork of the root enterprise stream is created by forking at least one of the enterprise stream blocks.
4. The system of claim 1 , wherein:
the machine is configured by the deployment server such that the respective machine authenticator, of the deployed machine, services the deployed machine with stream challenge requests, completes stream registration for the machine stream of the deployed machine, and manages the machine stream.
5. The system of claim 1 , wherein the seed is based also on one or more of:
a machine identifier of the machine,
a job identifier of a deployment job that deploys the machine, and
an environmental variable secret associated with at least one of the machine and the deployment job.
6. The system of claim 1 , wherein the stream generator is further configured to:
initialize the root enterprise stream to a distributed ledger network comprising a plurality of distributed nodes, each node among the plurality of distributed nodes storing the enterprise stream blocks.
7. The system of claim 6 , further comprising:
a memory configured to securely store the enterprise stream blocks.
8. The system of claim 6 , wherein the stream generator is further configured to:
select the enterprise stream blocks,
sign the enterprise stream blocks with a signing key associated with the root enterprise stream, and
transmit the enterprise stream blocks, signed with the signing key, to the distributed ledger network.
9. The system of claim 6 , further comprising: an authentication server configured to:
receive a root stream challenge, from the respective machine authenticator of the deployed machine, to initialize the machine authentication stream,
perform a verification of the root stream challenge based on retrieving at least one of the enterprise stream blocks from the distributed ledger network, and
initialize the machine authentication stream based on a result of the verification.
10. The system of claim 9 , wherein the respective machine authenticator of the deployed machine is configured to transmit the machine stream blocks to commit them to the distributed ledger network.
11. The system of claim 10 , wherein the machine stream blocks comprise at least one first machine stream block that is based on the at least one of the enterprise stream blocks and at least one second machine stream block generated by the respective machine authenticator of the deployed machine.
12. The system of claim 11 , further comprising:
an application server;
the deployed machine being configured to request an access to the application server;
the authentication server being configured to receive a stream challenge, generated by the respective machine authenticator of the deployed machine, relating to the access to the application server;
the stream challenge comprising a payload;
the payload comprising a hash value of at least one of the machine stream blocks;
the authentication server being configured to verify the stream challenge by checking the payload against the distributed ledger network to produce an authentication result; and
the machine accessing the application server depending on the authentication result.