# Multiple Resource Identities

In the previous section, we covered the basics of authentication using HexaEight Encryption and Decryption process by demonstrating how two programs with distinct Generic Resource Identities can authenticate with each other. However, there may be instances where managing multiple identities of the same resource is necessary to address scalability concerns or handle different operations. The following diagram illustrates one such scenario

%%{init: { 'theme': 'forest' } }%%
erDiagram
    Data-Set-A ||--|| Generic-Resource-Instance-1 : Reads
    Generic-Resource-Instance-1 ||--|{ Common-Data-Sink : And-Stores-In
    Generic-Resource-Instance-1 {
        Processes Data-Set-A
	Encrypts Data-Set-A
	Using Generic-Resource-2-Asymmetric-Shared-Key
    }

    Data-Set-B ||--|| Generic-Resource-Instance-2 : Reads
    Generic-Resource-Instance-2 ||--|{ Common-Data-Sink : And-Stores-In
    Generic-Resource-Instance-2 {
        Processes Data-Set-B
	Encrypts Data-Set-B
	Using Generic-Resource-2-Asymmetric-Shared-Key
    }

    Data-Set-C ||--|| Generic-Resource-Instance-3 : Reads
    Generic-Resource-Instance-3 ||--|{ Common-Data-Sink : And-Stores-In
    Generic-Resource-Instance-3 {
        Processes Data-Set-C
	Encrypts Data-Set-C
	Using Generic-Resource-2-Asymmetric-Shared-Key
    }

    Common-Data-Sink ||--|| Generic-Resource-2 : Reads
    Generic-Resource-2 {
        Processes Data-Received-From-Three-Instances
    }

• In the scenario described above, it is not advisable to share resource identity credentials among all instances if they are running on different systems. This is because a credential leak on one instance can lead to an attack on all instances since they share the same password.

• For better security, HexaEight Platform recommends generating multiple login tokens for the same resource with different passwords instead of sharing resource identity credentials across different instances.

• By generating multiple login tokens with different passwords, potential compromises can be detected, and in this example Generic-Resource-2 can be alerted to stop processing requests from the vulnerable instance based on the source identifier.

• It is important to understand that all the three instances of Generic-Resource-1 fetch different asymmetric shared keys from HexaEight Platform by using their individual Login Tokens.

• In this scenario Generic-Resource-1 fetches 3 different asymmetric shared keys of Generic-Resource-2, however since Generic-Resource-2 runs only one instance, it fetches the same asymmetric shared key of Generic-Resource-1 from HexaEight Platform.

To demonstrate this scenario, we have developed four programs, three of them running instances of Generic-Resource-1 and one instance Generic-Resource-2. We are also dumping the encrypted data into a free third party site called dweet.io as the common datasink.

The link for the sample programs is available below. You will need an API Key to execute these programs.

Generic Resource 1 - Instance 1

Generic Resource 1 - Instance 2

Generic Resource 1 - Instance 3

Generic Resource 2 - Single Instance

The output of Generic Resource 1 Instances are below :

Generic Instance 1 Data Set A (1) 4314397284692961805 Posted To Common Sink With Response : OK
Generic Instance 1 Data Set A (2) 3291438943102099610 Posted To Common Sink With Response : OK
Generic Instance 1 Data Set B (3) 5724686109214581236 Posted To Common Sink With Response : OK
Generic Instance 1 Data Set C (4) 3761553603542083283 Posted To Common Sink With Response : OK
Generic Instance 1 Data Set C (5) 5257767062494391521 Posted To Common Sink With Response : OK

The output of Generic Resource 2 Single Instances is below :

Displaying Latest Received Data
-------------------------------
Sender :A9CB8EFAF7D258CC03DCD71C37295B5FE7BE435DF13A43239D34EEDD4C21D464 Message :Generic Instance 1 Data Set B (3) 5724686109214581236 Sent At : 2023-02-22T15:54:23.266Z
Sender :A9CB8EFAF7D258CC03DCD71C37295B5FE7BE435DF13A43239D34EEDD4C21D464 Message :Generic Instance 1 Data Set C (5) 5257767062494391521 Sent At : 2023-02-22T15:54:02.994Z
Sender :A9CB8EFAF7D258CC03DCD71C37295B5FE7BE435DF13A43239D34EEDD4C21D464 Message :Generic Instance 1 Data Set C (4) 3761553603542083283 Sent At : 2023-02-22T15:54:01.487Z
Sender :A9CB8EFAF7D258CC03DCD71C37295B5FE7BE435DF13A43239D34EEDD4C21D464 Message :Generic Instance 1 Data Set A (2) 3291438943102099610 Sent At : 2023-02-22T15:53:41.082Z
Sender :A9CB8EFAF7D258CC03DCD71C37295B5FE7BE435DF13A43239D34EEDD4C21D464 Message :Generic Instance 1 Data Set A (1) 4314397284692961805 Sent At : 2023-02-22T15:53:39.453Z

%%{init: { 'theme': 'forest' } }%%
erDiagram
    entrydoor-Instance-1 ||--|| Robot-A : Requests-Entry
    Robot-A {
        Scans Source-Identifer-Displayed-As-QrCode
	Encrypts Request-For-entrydoor
	Sends Request-Via-Bluetooth-placed-near-the-door
    }

    entrydoor-Instance-2 ||--|| Robot-B : Requests-Entry
    Robot-B {
        Scans Source-Identifer-Displayed-As-QrCode
	Encrypts Request-For-entrydoor
	Sends Request-Via-Bluetooth-placed-near-the-door
    }

    entrydoor-Instance-3 ||--|| Robot-C : Requests-Entry
    Robot-C {
        Scans Source-Identifer-Displayed-As-QrCode
	Encrypts Request-For-entrydoor
	Sends Request-Via-Bluetooth-placed-near-the-door
    }