Automated authentication and authorization in a communication system
An application-operating organization may delegate a third-party server to serve as an automated contextual authentication responder and an authorization responder. The third-party server may manage a delegated section of the organization's namespace that includes the public identities of various devices controlled by the organization. The third-party server may also dynamically generate interaction control list that is tailored to a requesting device's context based on the interaction control policies set forth by the organization. The interaction control list may include information that determines the authorization of the requesting device to interact with another device. The third-party server may also automatically determine the role of a new device to which existing policies are inapplicable and provide guided workflow for the organization to set up new interaction control policies in governing the new device. The determination of the roles of devices may be based on an iterative process using external data sources.
1. A computer-implemented method comprising:
receiving, by a third-party server from an organization, one or more rules governing authentication of messages transmitted from a named entity device that is associated with the organization, the named entity device being an Internet-of-Things (IoT) device, the organization having a namespace, the third-party server delegated by the organization for managing a delegated namespace of the organization, the delegated namespace being a section of the namespace, a geographical restriction rule of the one or more rules governing an authorized geographical location of the named entity device serving as a message transmitter;
storing, in the delegated namespace, an identity record of the named entity device, the identity record comprising (i) a unique device identifier of the named entity device, the unique device identifier being distinct from IP address and having a format that is under the namespace of the organization, (ii) one or more contextual conditions of the named entity device, the one or more contextual conditions comprising the authorized geographical location of the named entity device, and (iii) a public key of the named entity device, the public key being associated with the unique device identifier in the identity record, the public key corresponding to a private key of the named entity device that is secretly kept by the named entity device;
receiving, by the third-party server, an authentication query from a recipient IoT device that attempts to authenticate a message transmitted from a transmitter IoT device purportedly associated with the unique device identifier belonging to the named entity device, the message comprising a digital signature signed by the private key of the named entity device, the digital signature comprising the unique device identifier and a timestamp at which the message was transmitted, the authentication query from the recipient IoT device including the digital signature in the message and a current geographical location of the recipient IoT device, wherein the authentication query that includes the current geographical information of the recipient IoT device and the digital signature is directed at the delegated namespace of the organization;
verifying, by the third-party server, the unique device identifier of the named entity device to confirm that the unique device identifier is under the namespace of the organization;
examining, by the third-party server, the current geographical location of the recipient IoT device and the digital signature using the geographical restriction rule provided by the organization for authenticating the message, wherein the examining comprises using the unique device identifier to retrieve the public key stored in the identity record to verify the digital signature and the timestamp and comparing the current geographical location of the recipient IoT device against the authorized geographical location of the named entity device serving as a message transmitter;
determine, by the third-party server and based on the unique device identifier and the geographical restriction rule, a response to the authentication query; and
transmitting, by the third-party server, the response to the message recipient, the response allowing the recipient IoT device to verify the message.
2. The computer-implemented method of claim 1 , wherein the public key of the named entity device is part of credential of the named entity device, the public key capable of authenticating the digital signature signed by the named entity device.
3. The computer-implemented method of claim 2 , wherein determining the response to the authentication query comprises:
retrieving the credential of the named entity device from a domain name system (DNS) address specified in the unique device identifier of the named entity device;
using the credential to verify attested metadata of the named entity device that is included in the message;
responsive to a successful verification, determining that the message is authenticated, wherein the response comprises an indication that the third-party server has determined that the message is authenticated.
4. The computer-implemented method of claim 1 , wherein the namespace is a domain name system (DNS).
5. The computer-implemented method of claim 4 , wherein the unique device identifier is an address in the DNS and the response to the authentication query comprises the public key of the named entity device, the public key being stored at the address.
6. The computer-implemented method of claim 4 , wherein the transmitter IoT device is an IoT sensor whose public key is stored in the DNS.