I want to build a distributed software system with the following elements:
- A number of workers, which manage potentially sensitive data and execute code on behalf of a number of clients.
- A number of clients, which can send commands to the workers.
- A central trust authority, which grants the right to execute actions on a given worker to a client.
In a typical operation, the client would contact the trust authority and request the authorization to execute an operation on a worker. The trust authority would authenticate the client and -if it succeeds- grant the authorization. The client would then connect to the worker server and issue the requested command, presenting the authorization that was obtained before. The worker server would be able check the validity of the authorization for the requested operation and -if it succeeds- perform it.
X.509 seems like a natural fit for this kind of problem, and the simplest solution I came up with looks like this:
- The trust authority uses a X.509 certificate to hand out authorizations to clients, signing them with the private key of the certificate.
- The client transmits the signed authorization from the trust authority to the worker server.
- The worker server downloads the public certificate from the trust authority's server and uses its public key to validate the authorization provided by the client.
To implement this, I would provide a HTTPS-based REST API on the trust authority server. Using this API, the worker server could download the public key certificate and locally validate it against a higher-level certificate (if it was signed by a CA). Using the public key obtained in this way the worker could then validate an authorization received from a client.
To obtain an authorization, a client could use another API endpoint on the trust authority, to which it provides all relevant details of the given command and worker server. The trust server would then respond with a signed authorization that the client can pass on to the worker server.
(in all of the steps above I assume that the communication between all parties can be secured and validated using some form of TLS)
My question regarding this setup is threefold:
- Is this a reasonable approach? If not, what would be?
- Against which possible attack scenarios would this scheme be vulnerable?
- Are there any open-source reference implementations of such a system?