Authentication System Access Token Mediator
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In communication systems where resources are distributed across multiple systems, the resource provision system cannot share client certificates used for authentication, hindering access to resources when the resource provision system is not connected to the authentication system.
Innovation Solution
An authentication system that establishes a first connection with a communication terminal using a client certificate, outputs an access token for authorization, and transmits this token to the terminal, allowing it to access a resource provision system through a separate connection, enabling the resource provision system to share authentication information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the resource provision system is not directly connected to the authentication system, then the authentication system's security and centralized control are maintained, but the resource provision system cannot share client certificates to authenticate terminals
Solution Approach 1:
The patent introduces an access token as an intermediary element that bridges the authentication system and resource provision system. The authentication system issues this token to the communication terminal after successful authentication, and the resource provision system verifies this token to grant access. This mediator allows the resource provision system to authenticate terminals without directly connecting to the authentication system or sharing sensitive client certificates, thus resolving the contradiction between maintaining security and enabling versatile resource access.
2Adaptability or versatility
If the resource provision system connects directly to the authentication system to share authentication information, then resource access is enabled, but the authentication and authorization management load increases
Solution Approach 1:
The patent extracts the authentication verification function from the authentication system itself and places it in the resource provision system through the use of access tokens. Instead of the resource provision system needing to connect to and share authentication information with the authentication system, the verification logic is taken out and embedded in the token. The resource provision system can independently verify tokens without involving the authentication system in the verification process, thereby reducing the authentication management load while maintaining resource access capability.
3Adaptability or versatility
If client certificates are shared between authentication system and resource provision system, then resource access is enabled, but security risks increase
Solution Approach 1:
The patent creates a copy of the authentication proof in the form of an access token. Instead of sharing the original client certificates between systems, the authentication system generates a token that copies the essential authentication information in a secure, verifiable format. This token can be verified by the resource provision system without exposing the actual client certificates. The copying mechanism enables resource access while maintaining security, as the token is a secure representation rather than the sensitive original authentication credentials.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An authentication system (30), a communication system (1), a method of performing authentication and authorization, and a carrier means carrying computer readable code for controlling a computer system to carry out the method. The authentication system and the method include establishing (S21) a first connection (tls1) with a communication terminal (10) after performing authentication with client certificate sent from the communication terminal (10), outputting (S24) authorization data corresponding to the client certificate, the authorization data indicating authorization for the communication terminal (10) to access a resource, and controlling (S32) the communication terminal (10) to transmit the authorization data to a resource provision system (60) through a second connection (tls2) different from the first connection (tls1). The communication system (1) includes the authentication system (30), and a resource provision system (60) that checks the authorization data and provides the communication terminal (10) with the resource.