Authentication Proxy for Seamless Service Password Rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently managing password rotation for service accounts across multiple applications without disrupting service, particularly in environments using Kerberos or LDAP protocols, due to the need to recognize both old and new passwords during extended transition periods.
Innovation Solution
An authentication proxy system with a Kerberos proxy server and companion proxy-registry database manages password changes by allowing simultaneous use of both old and new passwords until all servers are updated, using an account manager to coordinate and schedule password changes across a growing subset of servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password rotation is implemented for service accounts, then security is enhanced, but service disruptions occur during the transition period
Solution Approach 1:
The patent introduces an authentication proxy as an intermediary component between application servers and the authentication service. This proxy handles password rotation transparently by intercepting authentication requests, determining whether to use old or new passwords based on server update status, and forwarding appropriate credentials. This mediator approach allows password rotation without requiring application servers to be aware of or manually manage the transition, thus maintaining service continuity while enhancing security.
2Reliability
If password rotation is implemented across all servers simultaneously, then security is improved, but system complexity and coordination requirements increase
Solution Approach 1:
The patent implements a dynamic password rotation strategy where the authentication proxy continuously monitors and determines the update status of each application server. Instead of a static all-or-nothing approach, the system dynamically adapts by selecting appropriate passwords (old or new) based on real-time server states. This dynamic coordination reduces complexity by allowing incremental adoption rather than requiring simultaneous updates across all servers.
Solution Approach 2:
The authentication proxy performs preliminary determination of server update status before processing authentication requests. By pre-establishing knowledge of which servers have updated their passwords, the proxy can proactively select the appropriate credential version, avoiding complex real-time coordination and conflict resolution during authentication operations.
3Productivity
If extended transition periods are allowed for password rotation, then service continuity is maintained, but security risk increases due to prolonged use of old passwords
Solution Approach 1:
The patent applies local quality by allowing different authentication credentials to be used for different application servers based on their individual update status. Rather than using a single global password policy, the system tailors the authentication approach locally to each server's state - some servers use old passwords while others use new passwords. This granular approach enables extended transition periods for service continuity while minimizing security risk by ensuring each server uses the most current appropriate credential.
Data Source
AI summary
Disclosed is a method, system, and computer program product for rotating a password. According to the method, a proxy server receives a first service ID password from an application server. The proxy server determines whether to use the first service ID password to authenticate the application server at an authentication service based on a query of a database of password changes. Based on the determination of whether to use the first service ID password, the proxy server authenticates the application server at the authentication service using the first service ID password based on the determination or authenticates the application server at the authentication service by replacing the first service ID password with a second service ID password based on the determination.