Backup Authentication System Using Pre-Validated Packages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Authentication systems face outages, leading to principals being unable to authenticate and maintain access to resources when primary authentication systems are unavailable, resulting in service disruptions and increased resource consumption due to repeated authentication attempts.
Innovation Solution
Implementing a backup authentication system that receives an authentication package from the primary system, including an authentication artifact signed with a cryptographic key and metadata for credential verification, allowing the backup system to authenticate principals even when the primary system is unavailable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a primary authentication system is used to issue authentication artifacts in real time, then authentication security is maintained, but service availability deteriorates during system outages
Solution Approach 1:
The backup authentication system pre-receives and stores authentication packages from the primary authentication system while the primary system is operational. These packages include authentication artifacts and metadata that enable the backup system to authenticate principals without real-time communication with the primary system, ensuring service continuity during outages
Solution Approach 2:
An authentication package acts as an intermediary between the primary authentication system and the backup authentication system. The package contains pre-validated authentication artifacts and metadata that the backup system can verify independently, eliminating the need for real-time primary system communication while maintaining authentication integrity
2Device complexity
If authentication artifacts are issued in real time only, then system simplicity is maintained, but service continuity deteriorates during outages
Solution Approach 1:
The system performs preliminary actions by having the backup authentication system store authentication packages in advance. These packages contain pre-issued authentication artifacts with associated metadata including credential verification information and principal identifiers, enabling the backup system to function autonomously during primary system outages without complicating the overall authentication flow
Solution Approach 2:
The system changes the operational parameters of the backup authentication system from passive standby to active authentication capability. By pre-storing authentication packages with valid artifacts and metadata, the backup system transitions to a state where it can independently verify credentials and authenticate principals, extending service duration during outages
3Ease of operation
If repeated authentication attempts are made during outages, then user persistence is maintained, but resource consumption increases
Solution Approach 1:
The pre-stored authentication packages serve as intermediaries that enable the backup authentication system to respond to authentication requests without requiring repeated communication attempts with the primary system. This eliminates wasteful retry cycles while maintaining user ability to access services, reducing network traffic and computational resource consumption during outages
Data Source
AI summary
Techniques are described herein that are capable of using an authentication package from a primary authentication system to authenticate a principal by a backup authentication system. The authentication package includes an authentication artifact, which is signed with a cryptographic key by the primary authentication system and which includes claim(s) that are usable to authenticate the principal, and further includes metadata. The metadata includes credential verification information that is usable to verify a credential of the principal and a first principal identifier that identifies the principal. A request to authenticate the principal is received at the backup authentication system. The request includes the credential and a second principal identifier that identifies the principal. The principal is authenticated by the backup authentication system by verifying the credential using the credential verification information and further by determining that the first principal identifier corresponds to the second principal identifier.