Authentication Server Credential Collection via Modular Plug-in Architecture

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Authentication servers face challenges in implementing diverse and complex authentication schemes without modifying existing software logic, as they need to support various credential types and protocols, which is cumbersome and often requires changes to the access manager's program logic.

Innovation Solution

The implementation of a flexible credential collection mechanism where an access manager determines the required authentication scheme and interacts with custom modules to collect and authenticate credentials, using a plug-in architecture that allows new commands and protocols without altering the access manager's software instructions, and utilizing a credential collection module to handle unknown commands.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If diverse authentication schemes are implemented in an authentication server, then the authentication server can support various credential types and protocols, but the access manager's program logic requires frequent modifications

Engineering Contradiction:

Improveauthentication schemes supportVSAvoidsoftware logic complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The authentication server is segmented into distinct modules: access manager, credential collection module, and authentication scheme modules. Each module has a specific responsibility, allowing the system to support diverse authentication schemes without requiring modifications to the access manager's core logic. The credential collection module acts as an intermediary that handles the complexity of different authentication schemes.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The credential collection module serves as an intermediary between the access manager and various authentication schemes. It receives authentication requests from the access manager, determines which authentication scheme to use, collects credentials according to the appropriate scheme, and returns results to the access manager. This intermediary layer shields the access manager from the complexity of diverse authentication schemes.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If the access manager's software instructions are modified to support new authentication schemes, then new credential types can be handled, but existing software logic must be changed

Engineering Contradiction:

Improveauthentication scheme flexibilityVSAvoidsoftware modification ease

Core Design Contradiction:

Adaptability or versatilityVSEase of manufacture

Solution Approach 1:

The authentication scheme-specific logic is extracted from the access manager and placed in separate authentication scheme modules. The access manager retains only the core functionality of receiving authentication requests and returning results. When new authentication schemes need to be supported, only the new modules need to be added without modifying the existing access manager software.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The credential collection module is designed with universal functionality to handle multiple authentication schemes through a standardized interface. It can dynamically determine which authentication scheme to apply based on the request and collect appropriate credentials without requiring separate code paths for each scheme in the access manager.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Device complexity

If a rigid authentication framework is used, then the system structure is simple, but it cannot accommodate diverse authentication requirements

Engineering Contradiction:

Improvesystem structure simplicityVSAvoidauthentication scheme diversity

Core Design Contradiction:

Device complexityVSAdaptability or versatility

Solution Approach 1:

The authentication framework incorporates dynamic elements through the credential collection module, which can dynamically determine which authentication scheme to use based on the authentication request. The system maintains a simple core structure while allowing dynamic adaptation to diverse authentication requirements through configurable authentication schemes and a flexible credential collection process.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS8806589B2Credential collection in an authentication server employing diverse authentication schemes

Publication Date: 2014.08.12 ORACLE INT CORP

AI summary

An aspect of the present invention facilitates flexible credential collection in an authentication server employing diverse authentication schemes. In an embodiment, an access manager in the authentication server determines that an authentication scheme is to be used for allowing access to a resource requested by a user. A custom module (implementing the authentication scheme) in the authentication server then sends to the access manager commands indicating corresponding sets of credentials to be collected. The access manager, in response to receiving each command, collects the corresponding credentials from the user and checks whether the collected credentials authenticates the user. The custom module sends each command after the checking of the previously collected credentials. Accordingly, a developer of the custom module is enabled to request for and to perform the authentication of the user based on different sets of credentials.