Home > Design Patterns > Federated Cloud Authentication

Federated Cloud Authentication (Cope, Erl)

How can X.509 certificates from a federation of cloud consumers be authenticated when an associated certificate revocation list fails?

Federated Cloud Authentication

Problem

If the certificate revocation list (CRL) corresponding to a cloud consumer’s certificate is unavailable, either from communication or public key infrastructure (PKI) failure, cloud service providers are unable to authenticate submitted certificate credentials.

Solution

Federated authentication allows cloud services to authenticate cloud consumers incorporating a certificate status checking responder on the local area network (LAN), which supports authentication independently when the CRL for a given organization is unavailable due to failure.

Application

A local certificate validation service (CVS) is implemented to check the revocation status of submitted certificates from multiple organizations.
Federated Cloud Authentication: The component as a cloud service consumer sends the required certificate to an authentication service to be authenticated (1). The authentication service sends a request to the CVS that includes the issuer and serial number of the certificate (2). The CVS compares the serial number with the associated issuer’s CRL to determine if the certificate is revoked (3). The CVS signs a response indicating if the certificate is good, revoked, or unknown (4). The CVS also checks to see if the CRL is valid. If the CRL is stale and the CVS cannot retrieve a current one, the CVS can be configured to send an alert to a cloud resource administrator (5).

The component as a cloud service consumer sends the required certificate to an authentication service to be authenticated (1). The authentication service sends a request to the CVS that includes the issuer and serial number of the certificate (2). The CVS compares the serial number with the associated issuer’s CRL to determine if the certificate is revoked (3). The CVS signs a response indicating if the certificate is good, revoked, or unknown (4). The CVS also checks to see if the CRL is valid. If the CRL is stale and the CVS cannot retrieve a current one, the CVS can be configured to send an alert to a cloud resource administrator (5).

Federated Cloud Authentication: With the implementation of a CVS, the availability problems associated with an expired CRL are mitigated.

With the implementation of a CVS, the availability problems associated with an expired CRL are mitigated.

Federated Cloud Authentication: Resilient certificate validation in a cloud.

Resilient certificate validation in a cloud.