Explicit delegation with strong authentication
Systems and methods for performing explicit delegation with strong authentication are described herein. Systems can include one or more clients, one or more end servers, and one or more gateways intermediate or between the client and the end server. The client may include an explicit strong delegation component that is adapted to strongly authenticate the client to the gateway. The explicit strong delegation component may also explicitly delegate to the gateway a right to authenticate on behalf of the client, and to define a period of time over which the explicit delegation is valid. The system may be viewed as being self-contained, in the sense that the system need not access third-party certificate or key distribution authorities. Finally, the client controls the gateways or end servers to which the gateway may authenticate on the client's behalf.
1. A system comprising:
a client;
the client including an explicit strong delegation component that is adapted to:
provide a temporal certificate and an encrypted temporal private key to a first gateway, the temporal certificate includes a random challenge and a server-issued timestamp and the encrypted temporal private key is encrypted based on at least a public key of the first gateway;
strongly authenticate the client to the first gateway by using Transport Layer Security (TLS) as an authentication protocol with the temporal certificate and the encrypted temporal private key stored in USB tokens to produce non-reusable credentials, wherein the temporal certificate includes a temporal public key and the public key of the first gateway, the public key is a non-temporal public key;
explicitly delegate to a second gateway a right to authenticate on behalf of the client using the temporal certificate delegated by the client;
define a period of time over which the explicit strong delegation is valid;
the client is configured to rely on the temporal certificate to provide a mechanism for containing risk to the client, when a private key of the first gateway is compromised, the first gateway public key is revoked, and the temporal certificate that was granted to the first gateway is revoked;
the client is configured to rely on the temporal certificate to provide the mechanism for containing risk to the client, wherein:
when the private key of the first gateway is not compromised, the first gateway authenticates to the second gateway; and
the second gateway authenticates to an end server based on the end server returning acknowledgement of the random challenge and the server-issued timestamp.
2. The system of claim 1 , wherein the client and the first and the second gateways have no online connectivity with a third-party authority.
3. The system of claim 1 , wherein the client is adapted to limit the delegation so that the second gateway may authenticate on behalf of the client only to a specified entity.
4. The system of claim 1 , wherein the second gateway is adapted to authenticate to the end server based on the explicit delegation from the client.
5. The system of claim 1 , wherein the client is adapted to create the temporal credential, and to delegate the temporal credential to the second gateway.
6. The system of claim 5 , wherein the temporal credential includes one of a random challenge returned by the end server and a timestamp.
7. The system of claim 5 , wherein the temporal credential includes a temporal key pair, and wherein the temporal key pair is created by one of the client and the first gateway.
8. The system of claim 5 , wherein the temporal credential includes a name of first gateway.
9. A method executable, at least in part, on a computer-based device, the method comprising:
strongly authenticating to at least one gateway that is intermediate at least one client and at least one end server, wherein the authenticating uses Transport Layer Security (TLS) as an authentication protocol including a temporal certificate and an encrypted temporal private key stored in USB tokens to produce non-reusable credentials, the temporal certificate includes a random challenge and a server-issued timestamp the temporal certificate further includes a temporal public key and a gateway public key, the gateway public key is a non-temporal public key;
providing a mechanism for containing a risk to the client, when a private key of the at least one gateway is compromised, by revoking the gateway public key, then revoking the temporal certificate that was granted to the at least one gateway; and
when the private key of the at least one gateway is not compromised, explicitly delegating to the at least one gateway a right to authenticate on behalf of the client based on at least the temporal certificate delegated by the client and the at least one gateway authenticating to the end server based on the end server returning acknowledgement of the random challenge and the server-issued timestamp;
wherein the client and the at least one gateway have no online connectivity with a third-party authority.
10. The method of claim 9 , further comprising defining a period of time over which the explicit delegation is valid.
11. The method of claim 9 , further comprising creating the temporal credential that includes a temporal key pair, and further comprising delegating the temporal credential to the gateway.
12. The method of claim 9 , further comprising limiting the delegation so that the gateway may authenticate on behalf of the client only to a specified entity.
13. A method executable, at least in part, on a computer-based device, the method comprising:
strongly authenticating to at least one gateway that is intermediate at least one client and at least one end server, wherein the authenticating uses Transport Layer Security (TLS) as an authentication protocol including a temporal certificate that includes a random challenge and a server-issued timestamp and an encrypted temporal private key that is encrypted based on at least a public key of the gateway, stored in USB tokens to produce non-reusable credentials, wherein the temporal certificate includes a temporal public key and a public key of a gateway, the public key is a non-temporal public key;
providing a mechanism for containing a risk to the client when a private key of the gateway is compromised, by revoking the gateway public key, and then revoking the temporal certificate granted to the gateway;
defining a period of time over which the explicit delegation is valid;
when the private key of the gateway is not compromised, explicitly delegating at least to the gateway a right to authenticate on behalf of the client;
authenticating by the gateway to the at least one end server based on the at least one end server returning acknowledgement of the random challenge and the server-issued timestamp; and
limiting the delegation so that the gateway may authenticate on behalf of the client only to a specified entity.
14. The method of claim 13 , wherein the client and the gateway have no direct or indirect connectivity with a third-party authority.
15. The method of claim 13 , further comprising strongly authenticating to at least a second gateway that is intermediate the client and the end server, and further comprising explicitly delegating to the gateway a right to authenticate on behalf of the client to the second gateway; and further comprising explicitly delegating to the second gateway a right to authenticate on behalf of the client to the end server.
16. The method of claim 13 , further comprising limiting the delegation so that the gateway may authenticate on behalf of the client only to a plurality of specified entities.
17. The method of claim 13 , further comprising creating the temporal credential that includes a temporal key pair, and further comprising delegating the temporal credential to the gateway.
18. The method of claim 13 , further comprising receiving a random challenge from the end server, and further comprising incorporating the random challenge into a temporal credential.