Quorum-based authorization to secure sensitive cloud assets
Provided is a system and method to authenticate multiple users in order to secure sensitive cloud assets. The system comprises a user device, a service provider, and an identify provider. The service provider provides services for producing and consuming data. The identify provider authenticates and authorizes multiple authorizors for providing user access to the resources and data. A device app communicates with the service provider and identify provider. The device app polls votes and determines when a quorum approval for utilizing data is met within a constraint. It authorizes the user temporary access to the data for use by one of the services upon quorum approval, and enforces temporal and physical conditions on it. The access can be granted via a push action or a pull notification. Other embodiments are disclosed.
1. A system to authenticate multiple users to secure sensitive cloud assets, the system comprising:
a Hardware Security Module (HSM) that produces or consumes data, wherein access to the HSM and the data requires multi-user authentication from multiple authorizors by way of
a service provider communicatively coupled to the HSM to provide services for the producing and consuming the data, and
an identity provider communicatively coupled to the service provider to authenticate and authorize the multiple authorizors for providing the access to the HSM;
an user device executing a device app that in response to a user requesting access to the HSM or the data:
authenticates the user and multiple authorizors,
polls votes from the multiple authorizors and determines when a quorum approval for utilizing the data is met within a constraint,
authorizes the user with a temporary access to the data for use by one of the services upon the quorum approval in accordance with temporal and physical conditions; and
enforces the temporal conditions and the physical conditions on the temporary access to the HSM;
a bridge device communicatively coupled to an in-band network and an out-of-band network connected to the HSM that transfers data there between; and
a process daemon that is configurable via the device app and controls an air-gapped switching of data between the secure in-band network and the out-of-band network responsive to the quorum approval,
wherein the HSM comprises a quorum web service Applications Programming Interface (API) to enforce quorum policy and handle quorum requests related to the quorum approval,
wherein the process daemon by way of the bridge device transfers an image from a dev-ops platform to the HSM responsive to the device app receiving the quorum approval for the user performing a code signing ceremony,
wherein the HSM securely signs the image using private keys thereon to produce a signed image during the code signing ceremony,
and thereafter, the process daemon by way of the bridge device transfers the signed image from the HSM back to the dev-ops platform;
wherein
a build server provides out-of-band resources on the out-of-band network comprising code, artifacts, audit logs, configuration files, and the image,
the dev-ops platform sourcing the image provides out-of-band services on the out-of-band network; and
the HSM hosting the code signing ceremony provides in-band resources and services on the in-band network to provide a secure computing environment with controlled ingress and egress of the image, data or artifacts.
2. The system of claim 1 , wherein the constraint comprises
a temporal constraint with a time window having a fixed start point and either an end point or duration, and
the quorum approval is achieved when a predetermined number of authorizors have been authenticated and have authorized access to data, service or the HSM requested by the user in accordance with the temporal constraint.
3. The system of claim 1 , wherein the constraint comprises
a physical constraint based on a geographic point at a precise location on the earth or within a configurable radius from a precise location on earth; and
the quorum approval is achieved when a predetermined number of authorizors have been authenticated and have authorized access to data, service or the HSM requested by the user in accordance with the physical constraint.
4. The system of claim 1 , wherein authorizing temporary access is via a push action or a pull notification.
5. The system of claim 1 , wherein the bridge device is configurable via a back-end cloud integration RESTful quorum API offered by the service provider.
6. The system of claim 1 , wherein the bridge device is configurable via a gRPC quorum API offered by the service provider.
7. The system of claim 1 , wherein the bridge device interchangeably couples the app to either of the in-band resources or the out-of-band resources indirectly via TCP/IP connection.
8. The system of claim 1 , wherein the HSM includes one among a secure console, a Key Management System (KMS), another Hardware Security Module, or other secure device.
9. A method for authenticating multiple users to secure sensitive cloud assets, by way of a device app executing on a user device, that in response to a user requesting access to a Hardware Security Module (HSM) or data within a computing environment, performs the steps of:
authenticating the user requesting access to the HSM producing or consuming the data within the computing environment, wherein access to the HSM and data requires multi-user authentication from multiple authorizors; and
authorizing the user with a temporary access to data for use by a service within the computing environment upon determining a quorum approval in accordance with temporal and physical conditions,
where the device app:
authenticates the user and the multiple authorizors,
polls votes from the multiple authorizors to determines when the quorum approval for utilizing data is met within a constraint; and
enforces the temporal conditions and physical conditions on the temporary access to the HSM,
wherein the HSM comprises a quorum web service Applications Programming Interface (API) to enforce quorum policy and handle quorum requests related to the quorum approval, that by way of
a bridge device communicatively coupled to an in-band network and an out-of-band network connected to the HSM transfers data there between, and
a process daemon that is configurable via the device app controls an air-gapped switching of data between the secure in-band network and the out-of-band network responsive to the quorum approval,
wherein the process daemon by way of the bridge device transfers an image from a dev-ops platform to the HSM responsive to the device app receiving the quorum approval for the user performing a code signing ceremony,
wherein the HSM securely signs the image using private keys thereon to produce a signed image during the code signing ceremony,
and thereafter, the process daemon by way of the bridge device transfers the signed image from the HSM back to the dev-ops platform;
wherein
a build server provides out-of-band resources on the out-of-band network comprising code, artifacts, audit logs, configuration files, and the image,
the dev-ops platform sourcing the image provides out-of-band services on the out-of-band network; and
the HSM hosting the code signing ceremony provides in-band resources and services on the in-band network to provide a secure computing environment with controlled ingress and egress of the image, data or artifacts.
10. The method of claim 9 , wherein the constraint comprises
a temporal constraint with a time window having a fixed start point and either an end point or duration,
a physical constraint based on a geographic point at a precise location on the earth or within a configurable radius from a precise location on earth; and
the quorum approval is achieved when a predetermined number of authorizors have been authenticated and have authorized access to data, service or the HSM requested by the user,
in accordance with the temporal constraint and the physical constraint.
11. The method of claim 10 , wherein the method includes
notifying, by way of the device app, the authorizors that a request for using the HSM or accessing data is pending, and
confirming a vote via a push action or a pull notification responsive to the notifying in accordance with the temporal constraint and the physical constraint.