Adaptive Authentication Indexing for Federated Identity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In federated environments, a single identity provider handles authentication requests for multiple users and service providers using a single access policy, leading to suboptimal user experience and unnecessary resource utilization.
Innovation Solution
A network traffic management system that identifies the relevant web application server and generates an authentication request with an index based on client data, allowing for adaptive authentication and selective enforcement of access control checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single access policy is configured at the identity provider for all users and service providers, then the system is simple to manage, but the user experience becomes suboptimal and resource utilization increases unnecessarily
Solution Approach 1:
The patent segments the single access policy into multiple access policies indexed by web application server. Each access policy is tailored to specific service providers and users, allowing differentiated authentication approaches. The index in the authentication request routes to the appropriate access policy, enabling customized user experiences while maintaining manageable system complexity through structured organization.
Solution Approach 2:
The patent implements local quality by making access policies specific to particular web application servers and service providers rather than applying a uniform policy globally. Each access policy is optimized for its specific context, providing locally appropriate authentication requirements that enhance user experience for each service provider while maintaining overall system manageability.
2Device complexity
If a single access policy is used for all authentication requests, then the system is easier to configure, but resource utilization on the identity provider increases unnecessarily
Solution Approach 1:
The patent divides the monolithic access policy into multiple segmented access policies indexed by web application server. This segmentation allows the identity provider to evaluate only the relevant access policy for each authentication request rather than processing a single comprehensive policy, reducing computational overhead and resource utilization while maintaining configuration manageability through the indexing mechanism.
Solution Approach 2:
The patent performs preliminary action by pre-indexing access policies according to web application server identifiers before authentication requests arrive. This pre-organization enables rapid retrieval and evaluation of the specific access policy needed for each request, reducing real-time processing requirements and resource utilization on the identity provider while keeping the system relatively simple to configure.
3Device complexity
If authentication requests are handled without indexing, then the system is simpler, but authentication speed and optimization are reduced
Solution Approach 1:
The patent applies preliminary action by pre-computing and including an index in the authentication request that identifies the relevant web application server. This index is calculated beforehand based on the request characteristics, enabling the identity provider to immediately retrieve the appropriate access policy without extensive searching or evaluation, thereby significantly improving authentication speed while adding only minimal structural complexity to the request.
Solution Approach 2:
The patent introduces an index as an intermediary element between the authentication request and the access policy evaluation. This index acts as a mediator that bridges the request and the appropriate policy, enabling fast routing and evaluation. The index adds minimal complexity to the request structure while providing substantial performance benefits by enabling direct access to the relevant access policy.
Data Source
AI summary
Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with providing adaptive authentication for federated environment includes receiving a request to access an application from a client. Next, one of a plurality of web application servers in which the requested application is executing is identified and data associated with the requesting client is obtained. An authentication request comprising an index based on the identified web application server and the obtained client data is generated. The requesting client using the generated authentication request including the index is authenticated.