A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to systems B, C, D, ... These sub-requests are based on the original request (in other words they are semantically related to the original request), but the body of these sub-requests is absolutely different from the original request. It's also important to note that the sub-requests are not generated and send after original request immediately. It can be done during days and weeks.

In other words, a user gives a task to the system A to send requests to systems B, C, D, ... during a long enough period of time.

The problem is that the systems B, C, D doesn't trust to the system A. They requires to be sure that the sub-requests are actually based on the original request of the user. The problem is that some evil administrator of system A can send requests to systems B, C, D and have an unauthorized access to a secured information.

It seems that it's absolutely impossible to prevent such a security violation.

The only solution is to let system A to send each sub-request to the user first. The user will sign it. And then system A will send it to other systems. But it's a very complicated solution, because the sub-requests can be generated at any time during a long period. So we will have to distract the user often.

Could you please suggest another approach?

  • Does the client know that requests to B, C and D will be needed? If so, have the client write out the requests, sign them and include them in the request to A so that A can use them when needed. – Anders Apr 7 '20 at 11:49
  • No, he doesn't. He makes a very simple request. And system A creates a detailed sub-requests. Only system A knows what requests to B, C, D will be needed. I think system A is like an attorney. The users gives a letter of attorney to A. Then A represents the interests of the user. – Denis Apr 7 '20 at 12:00
  • And the idea is that system A (attorney, agent) should not have more permissions than the user itself. The problem is that A can represent the interests of different users with different permissions. – Denis Apr 7 '20 at 12:05
  • 1
    Then I think your conclusion is correct, that the best you can do is to have the user sign the requests for B, C and D. If A can predict the need for them early, it could ask the user for signatures immediately instead of waiting until the requests are issued. – Anders Apr 7 '20 at 14:54
  • 1
    To your Thanks comment, does the user know the body of the requests in advance? How about you make the user a CA and system A subordinate one so that A can sign the sub-requests? – postoronnim Apr 7 '20 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.