Delegated authentication to certificate authorities

Disclosed are various embodiments for delegating authentication to certificate authorities. A first request for a certificate is received from a client device. Then a certificate request can be created. The certificate request may include a credential identifier for a certificate authority. The credential identifier may uniquely identify an authentication credential to use to request the certificate from certificate authority. The certificate request can then be added to a message queue. Later, a second request from another computing device is received and the message stored in the message queue is provided in response. A certificate is then received from the other computing device and is provided to the client device in response to the first request.

BACKGROUND

Enterprise services are often hosted by the vendor or the provider of the service off-premises, which is often referred to as being hosted in the cloud. For example, vendors of enterprise mobility management (EMM) services and mobile device management (MDM) services often offer a version that can be locally hosted by a customer and another version hosted by the vendor on behalf of the customer. In versions hosted on behalf of the customer, sensitive data (e.g., administrative and service account credentials) is often uploaded by the customer to the vendor's servers and databases. Should the vendor suffer a security breach, the customer's sensitive data may be exposed to unauthorized parties.

DETAILED DESCRIPTION

Disclosed are various approaches for delegating authentication with certificate authorities to third-parties. Often, an enterprise mobility management (EMM) or mobile device management (MDM) system will be operated by a vendor or provider of the EMM or MDM system. The computing systems and data stores are often operated by the vendor or provider of the EMM or MDM service. Sensitive data, such as administrative or system account credentials, is often stored by the provider of the EMM or MDM service in order for the EMM or MDM service to obtain and issue certificates to client devices. These credentials are often provided by the users of the EMM or MDM service hosted by the vendor or provider. In the event that the vendor or provider suffers a security breach, these credentials may be leaked to malicious third-parties or other unauthorized users or entities. To address this security risk, storage of authentication credentials can be delegated to the users of the EMM or MDM service, as described in further detail herein.

With reference toFIG. 1, shown is a network environment100according to various embodiments. The network environment100includes a management computing environment103, an enterprise computing environment106, and a client device109, which are in data communication with each other via a network113. The network113includes wide area networks (WANs) and local area networks (LANs). These networks can include wired or wireless components or a combination thereof. Wired networks can include Ethernet networks, cable networks, fiber optic networks, and telephone networks such as dial-up, digital subscriber line (DSL), and integrated services digital network (ISDN) networks. Wireless networks can include cellular networks, satellite networks, Institute of Electrical and Electronic Engineers (IEEE) 802.11 wireless networks (i.e., WI-FI®), BLUETOOTH® networks, microwave transmission networks, as well as other networks relying on radio broadcasts. The network113can also include a combination of two or more networks113. Examples of networks113can include the Internet, intranets, extranets, virtual private networks (VPNs), and similar networks.

The management computing environment103or the enterprise computing environment106can include a server computer or any other system providing computing capability. Alternatively, the management computing environment103or the enterprise computing environment106can employ a plurality of computing devices that can be arranged in one or more server banks or computer banks or other arrangements. Such computing devices can be located in a single installation or distributed among many different geographical locations. For example, the management computing environment103or the enterprise computing environment106can include a plurality of computing devices that together form a hosted computing resource, a grid computing resource, or any other distributed computing arrangement. In some cases, the management computing environment103or the enterprise computing environment106can correspond to an elastic computing resource where the allotted capacity of processing, network, storage, or other computing-related resources can vary over time.

Various applications or other functionality can be executed in the management computing environment103according to various embodiments. The components executed in the management computing environment103, for example, include a management service116, a messenger service119, and other applications, services, processes, systems, engines, or functionality not discussed in detail herein.

Also, various data can be stored in a management data store123that is accessible to the management computing environment103. The management data store123can be representative of a plurality of data stores, which can include relational databases, object-oriented databases, hierarchical databases, hash tables or similar key-value data stores, as well as other data storage applications or data structures. The data stored in the management data store123is associated with the operation of the various applications or functional entities described below. This data can include one or more certificate authority (CA) authentication maps126, a message queue129, and potentially other data.

The CA authentication map126represents a table, mapping, key-value store, or other data structure that stores a relationship between a CA identifier133and a credential identifier136. The CA identifier133can represent a unique identifier for a certificate authority139. For example, the CA identifier133can include a hostname for the certificate authority139, a globally unique identifier (GUID), a universally unique identifier (UUID), a security identifier (SID), or other identifier that uniquely identifies a certificate authority139with respect to another certificate authority139. In some implementations, the CA identifier133can also represent a domain name (e.g., using the domain name “example.com” as an identifier for any certificate authority139that is authorized to issue certificates for the “example.com” domain).

The credential identifier136can represent an identifier of authentication credentials143for a certificate authority139that uniquely identifies the authentication credentials143with respect to other sets of authentication credentials143for the certificate authority139. Various data structures or types can be used as a credential identifier136. For example, the credential identifier136could represent a result of a cryptographic hash function applied to respective authentication credentials143. As another example, the credential identifier136could be based on an incremented numeric counter (e.g., where the first set of authentication credentials143is identified by the number “1,” the second set of authentication credentials143is identified by the number “2,” etc.).

Authentication credentials143can include a combination of a username and password, a public-private authentication key pair, a pre-shared cryptographic key, an authentication certificate, or other authentication mechanism that allows a user or application to authenticate with the certificate authority139(e.g., for the purpose of issuing or revoking a certificate). A respective pair of a CA identifier133and a credential identifier136may be stored for each certificate authority139.

The message queue129stores messages146to be delivered to an application executing on a computing device. For example, the messenger service119may create and store a message146in a message queue129. A messenger connector149executing in the enterprise computing environment106may then retrieve one or more messages146from the message queue129. In some instances, a message queue129may be created and associated with each instance of a messenger connector149executing in an enterprise computing environment106. In other implementations, messages146destined for different messenger connectors149can be stored in a single message queue129. A message146can include any data or command to be sent to the messenger connector149or other application or service. In some instances, a message146can include both a command, as well as data (e.g., function arguments) related to the command.

The management service116can be executed to administer the operation of client devices109registered or otherwise enrolled with the management service116. To this end, the management service116can also provide mechanisms for a client device109to enroll or otherwise register with the management service116. The management service116can also enforce the use of policies assigned to a client device109, manage applications installed on client devices109, and perform various other functions related to the management of enrolled client devices109.

The messenger service119can be executed to send messages146to and receive messages146from client devices109or components of the enterprise computing environment106. For example, the messenger service119may create a message146for a computing device, application, or service and store the message146in a message queue129in response to an action performed by the management service116. The messenger service119can also periodically check the message queue129for messages received from respective computing devices or applications. In some instances, the messenger service119may also directly receive a message146from a computing device, application, or service.

Various applications or other functionality can be executed in the enterprise computing environment106according to various embodiments. The components executed in the enterprise computing environment106, for example, include a messenger connector149, a certificate authority (CA)139, and other applications, services, processes, systems, engines, or functionality not discussed in detail herein.

Also, various data can be stored in an enterprise data store153that is accessible to the enterprise computing environment106. The enterprise data store153can be representative of a plurality of data stores, which can include relational databases, object-oriented databases, hierarchical databases, hash tables or similar key-value data stores, as well as other data storage applications or data structures. The data stored in the enterprise data store153is associated with the operation of the various applications or functional entities described below. This data can include one or more authentication credentials maps156, certificates159, and potentially other data.

The authentication credentials map156stores a record of a relationship between a credential identifier136and authentication credentials143. The authentication credentials map156can include a table, map, key-value store, or similar data structure. As previously discussed, authentication credentials143can include a combination of a username and password, a public-private authentication key pair, an authentication certificate, or other authentication mechanism that allows a user or application to authenticate with the certificate authority139(e.g., for the purpose of issuing or revoking a certificate).

The certificates159represent cryptographic certificates159issued by a certificate authority139. A certificate159can represent a certification or verification of the ownership of a public key identified by the certificate159. For example, a certificate159can include information about a public key of a public-private key-pair (e.g., a fingerprint of a public key or a copy of the public key itself), an identity of the owner of the public key (e.g., the name of the owner and contact information for the owner), and a digital signature that verifies the contents of the certificate159. Certificates159can be used for various purposes, such as verifying the identity of an individual, a machine, or an application, encrypting communications between parties, code-signing, and other purposes.

The certificate authority139can be executed to issue certificates159to users, applications, or machines that submit a request for a certificate159. The certificate authority139can verify the identity of the user, application, or machine. The certificate authority139can also determine whether the user, application, or machine is authorized to receive a certificate159from the certificate authority139.

The messenger connector149can be executed to retrieve messages146from the message queue129and send messages146to the messenger service119. For example, the messenger connector149can regularly send a request to the messenger service119for any messages146stored in the message queue129allocated for the enterprise computing environment106. The messenger connector149can also send a message146to the messenger service119when information needs to be passed to the messenger service119(e.g., a response to a message146retrieved from the message queue129). Because the messenger connector149initiates each communication with the messenger service119, a firewall for the enterprise computing environment106does not need to be configured to leave a port open to receive messages146.

The client device109is representative of a plurality of client devices that can be coupled to the network113. The client device109can include, for example, a processor-based system such as a computer system. Such a computer system can be embodied in the form of a personal computer (e.g., a desktop computer, a laptop computer, or similar device), a mobile computing device (e.g., personal digital assistants, cellular telephones, smartphones, web pads, tablet computer systems, music players, portable game consoles, electronic book readers, and similar devices), media playback devices (e.g., media streaming devices, BluRay® players, digital video disc [DVD] players, set-top boxes, and similar devices), a videogame console, or other devices with like capability. The client device109can include one or more displays, such as liquid crystal displays (LCDs), gas plasma-based flat panel displays, organic light emitting diode (OLED) displays, electrophoretic ink (“E-ink”) displays, projectors, or other types of display devices. In some instances, the display can be a component of the client device109or can be connected to the client device109through a wired or wireless connection. The client device109can also be configured to execute various applications such as an operating system, a management agent163, and potentially other client applications.

The management agent163can be executed to interact with the management service116on behalf of the client device109. For example, the management agent163can be used to register the client device109with the management service116, maintain data communication with the management service116, enforce the policies received from the management service116, or perform commands received from the management service116. For instance, the management agent163can maintain (e.g., update, reconfigure, uninstall, etc.) managed applications installed on the client device109according to one or more policies. As another example, the management agent163can request, install, and manage certificates159provided by the certificate authority139.

Next, a general description of the operation of the various components of the network environment100is provided. More specific and detailed descriptions of the individual components of the network environment100are provided with the discussion of subsequent figures.

To begin, the management agent163sends a request for a certificate159to the management service116. The request for the certificate159may be sent as part of an enrollment or registration process. However, the request for the certificate159may also be sent in other contexts (e.g., upon first use of an application that uses certificates159for user or device authentication). The request may include information related to the request for the certificate159, such as a CA identifier133for the certificate authority139and the type of certificate159to be issued.

In response, the management service116creates a request for a certificate159. The management service116can use the CA identifier133to retrieve a respective credential identifier136from the CA authentication map126in the management data store123. The management service116can then send the certificate request and the credential identifier136to the messenger service119.

The messenger service119can then create a message146. The message146can contain the credential identifier136selected by the management service116and the certificate request. The messenger service119can then identify a message queue129for the respective certificate authority139and store the message146in the message queue219. For example, the messenger service119may identify a message queue129associated with the CA identifier133and store the message146in the associated message queue129.

Subsequently, the messenger connector149can send a request to the messenger service119for any messages146stored in the message queue129. The request for messages146may be sent at periodic intervals (e.g., every minute, every two minutes, every five minutes, every hour, etc.). In response, the messenger service119can send the messages146stored in the message queue129to the messenger connector149. The messenger service119may then delete the messages146from the message queue129after they have been sent to the messenger connector149.

The messenger connector149can then parse or otherwise analyze the messages146retrieved from the messenger service119and initiate or perform an action based on the contents of a message146. For example, the messenger connector149may evaluate a message146to determine that the message146includes a certificate request and a credential identifier136. The messenger connector149can then retrieve respective authentication credentials143from the authentication credentials map156by querying the enterprise data store153. For example, the messenger connector149may search the authentication credentials map156for the authentication credentials143stored in association with the credential identifier136included in the message146.

After retrieving the authentication credentials143, the messenger connector149can submit the certificate request to the certificate authority139. The certificate request can include the authentication credentials143or the authentication credentials143may be subsequently submitted to the certificate authority139in response to a request for the authentication credentials from the certificate authority. For instance, the certificate authority139may evaluate the certificate request and then request the authentication credentials143from the messenger connector149.

After receiving the certificate request and the authentication credentials143, the certificate authority139can evaluate the certificate request and the authentication credentials143. If the certificate request and the authentication credentials143are valid, and the authentication credentials143are for an authorized user, application, or machine, then the certificate authority139may issue a certificate159. A copy of the issued certificate159may be stored in the enterprise data store153, while another copy of the issued certificate159may also be provided to the messenger connecter149.

In response, the messenger connector149can send the issued certificate159to the messenger service119. The messenger service119can, in turn, provide the issued certificate159to the management service116. The management service116can then send the issued certificate159to the management agent163in response to the certificate request.

Referring next toFIG. 2, shown is a flowchart that provides one example of the operation of a portion of the management service116. It is understood that the flowchart ofFIG. 2provides merely an example of the many different types of functional arrangements that can be employed to implement the operation of the management service116. As an alternative, the flowchart ofFIG. 2can be viewed as depicting an example of elements of a method implemented in the management computing environment103.

Beginning at step201, the management service116may authenticate or enroll a client device109. For example, the management agent163may send a username and password or other credentials to the management service116. The management service116may evaluate the credentials supplied by the management agent163to determine whether the management agent163is authorized to interact with the management service116. In some instances, the management agent163may send the credentials as part of an enrollment or registration process or request.

At step203, after authenticating the management agent163, the management service116may receive a request for a certificate159from the management agent163. The request may be sent as part of an enrollment or registration process. However, the request may also be sent independent of enrollment or registration of the client device109(e.g., as part of the installation process of an application that uses a certificate159for client authentication). The request may also include a CA Identifier133that specifies which certificate authority139is to issue the requested certificate159.

Next at step206, the management service116can create a certificate request. For example, the management service116may create a request formatted for the certificate authority139. The certificate request may also include the credential identifier136associated with the certificate authority139. To determine the credential identifier136, the management service116may query the management data store123to search for a record in the CA authentication map126that contains the CA identifier133supplied by the management agent163. The management service116could then use the corresponding or respective credential identifier136.

Then at step209, the management service116can send or otherwise provide the certificate request and/or the credential identifier136for the certificate authority139to the messenger service119. For instance, the management service116may invoke a function provided by an application programming interface (API) made available by the messenger service119to provide the certificate request and/or the credential identifier136.

The management service can then wait until, at step213, it receives a response from the messenger service119. The response can include the certificate159issued by the certificate authority139in response to the certificate request.

The management service116can then provide the certificate159to the management agent163at step216. For example, the management service116may generate a response that includes the certificate159and other information (e.g., a signature to verify the authenticity of the response, etc.)

Referring next toFIG. 3, shown is a flowchart that provides one example of the operation of a portion of the messenger connector149. It is understood that the flowchart ofFIG. 3provides merely an example of the many different types of functional arrangements that can be employed to implement the operation of the messenger connector149. As an alternative, the flowchart ofFIG. 3can be viewed as depicting an example of elements of a method implemented in the management computing environment103.

Beginning at step303, the messenger connector149can send a request to the messenger service119for any messages146stored in a respective message queue129. The messenger connector149can receive any messages146present in the message queue129in response. The messenger connector149may periodically request messages from the messenger service119in order to retrieve new messages146added to the message queue129by the messenger service119.

Next at step306, the messenger connector149can evaluate any messages146received from the messenger service119. For example, the messenger connector149may determine that a message includes a certificate request and a credential identifier136.

Then at step309, the messenger connector149can retrieve the authentication credentials143identified by the respective credential identifier136. For example, the messenger connector149may query the authentication credentials map156located in the enterprise data store153to identify the authentication credentials143associated with the credential identifier136.

Proceeding to step313, the messenger connector149can then send the certificate request specified in the message146and the authentication credentials143retrieved from the enterprise data store153to a certificate authority139located within the enterprise computing environment106. At step316, the messenger connector149can receive a certificate159from the certificate authority in response. Subsequently at step319, the messenger connector149can send the certificate159to the messenger service119as a response to the message146containing the certificate request.

Referring next toFIG. 4, shown is a sequence diagram depicting the interaction between various components of the network environment100. It is understood that the sequence diagram ofFIG. 4provides merely an example of many different types of interactions between the individual components of the network environment100. As an alternative, the sequence diagram ofFIG. 4can be viewed as depicting an example of elements of a method implemented in the network environment100.

Beginning at step401, the management agent163can request a certificate159from the management service116. The request can include a CA identifier133and potentially other information. For example, the request may also include authentication information to allow the management agent163to authenticate or verify its identity with the management service116.

Next at step403, the management service116can authenticate the request received from the management agent163. For example, the management service116may verify user account credentials provided by the management agent163to verity that the management agent163has enrolled the client device109with the management service116. Additional authentication measures can be performed according to the details of particular implementations.

If the management agent163is successfully authenticated by the management service116, then the management service116can create a certificate request at step406, as previously described. For example, the management service116may use the CA identifier133to determine the credential identifier136for the certificate authority139that will issue the requested certificate159. The management service116may then use the CA identifier133, the credential identifier136, and other relevant information to create the certificate request.

The management service116can then send the certificate request, which can include the credential identifier136, to the messenger service119at step409. For example, the management service116may invoke a function defined by an API provided by the messenger service119to send the certificate request and credential identifier136to the messenger service119. The management service116may also provide the CA identifier133to the messenger service119to assist the messenger service119in determining which message queue129to use to facilitate relaying the certificate request to an appropriate messenger connector149.

Then at step413, the messenger service119can create a message146containing the certificate request and the credential identifier136. The message146can then be added to a message queue129for temporary storage of the message146until the messenger connector149can request the message146from the messenger service119.

Next, at step416, the messenger connector149can retrieve any messages146stored in the message queue129, including the message146containing the certificate request and the credential identifier136. For example, the messenger connector149may establish a connection with the messenger service119and send a request containing an identifier of the messenger connector149. In response, the messenger service119may return any messages146stored in a message queue129associated with the identifier of the messenger connector149. In some instances, the messenger connector149may use the CA identifier133of the certificate authority139for which the messenger connector149is retrieving messages146.

After evaluating the message146, at step419, the messenger connector149can retrieve from the enterprise data store153the authentication credentials143identified by the credential identifier136. For example, the messenger connector149may query the authentication credentials map156to select the authentication credentials143associated with the credential identifier136included in the retrieved message146.

The messenger connector149can then request a certificate159at step423from the certificate authority139by sending the certificate request and the authentication credentials143to the certificate authority139. After sending the certificate request to the certificate authority139, the messenger connector149may wait to receive a response.

In response to receiving the certificate request and the authentication credentials143, the certificate authority139can issue a certificate159at step426. For example, the certificate authority139may validate or verify the authentication credentials143. If the authentication credentials143are valid, the certificate authority139can generate a certificate159that satisfies the parameters specified in the certificate request. The certificate authority139can then issue the certificate159by returning the certificate to the messenger connector149.

The issued certificate159can then be ultimately relayed back to the management agent163. For example, after receiving the issued certificate159, the messenger connector149can, at step429, return the issued certificate159to the messenger service119as a response to the message retrieved at step416. Then at step433, the messenger service119can return the certificate159to the management service116. The management service116can then ultimately return the issued certificate159to the management agent163at step436as a response to the original request for the certificate159that was sent by the management agent163at step401.

The flowcharts show examples of the functionality and operation of various implementations of portions of components described in this application. If embodied in software, each block can represent a module, segment, or portion of code that can include program instructions to implement the specified logical function(s). The program instructions can be embodied in the form of source code that can include human-readable statements written in a programming language or machine code that can include numerical instructions recognizable by a suitable execution system such as a processor in a computer system or other system. The machine code can be converted from the source code. If embodied in hardware, each block can represent a circuit or a number of interconnected circuits to implement the specified logical function(s).

Although the flowcharts show a specific order of execution, it is understood that the order of execution can differ from that which is depicted. For example, the order of execution of two or more blocks can be scrambled relative to the order shown. In addition, two or more blocks shown in succession can be executed concurrently or with partial concurrence. Further, in some examples, one or more of the blocks shown in the drawings can be skipped or omitted.

The computer-readable medium can include any one of many physical media, such as magnetic, optical, or semiconductor media. More specific examples of a suitable computer-readable medium include solid-state drives or flash memory. Further, any logic or application described herein can be implemented and structured in a variety of ways. For example, one or more applications can be implemented as modules or components of a single application. Further, one or more applications described herein can be executed in shared or separate computing devices or a combination thereof. For example, a plurality of the applications described herein can execute in the same computing device, or in multiple computing devices.