Centralized Authentication System for Web Service Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web service applications have difficulty integrating digital certificate technology for authentication, as they are typically designed to authenticate users based on IDs embedded in service requests, failing to recognize IDs encoded in digital certificates.
Innovation Solution
A Centralized Authentication & Authorization system (CAA) that includes a Service Request Filter (SRF), a Service Client Authentication Program (SCAP), and an Authorization Database (ADB), which intercepts service requests, extracts and validates digital certificates, and authorizes service requests, facilitating secure communication between web service applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web service applications use traditional ID/password authentication methods, then they can authenticate users based on IDs embedded in service requests, but they face security risks from password disclosure and require complex password policies
Solution Approach 1:
The patent introduces a certification authority as an intermediary that issues digital certificates to service clients. These certificates contain public keys and identity information, replacing the need for direct password-based authentication between client and service provider. The intermediary (certification authority) establishes trust by signing the client's public key, allowing secure authentication without exposing passwords.
Solution Approach 2:
The patent replaces the mechanical password verification system with a cryptographic public key infrastructure. Instead of transmitting and verifying passwords through network protocols, the system uses digital signatures and public key cryptography embedded in digital certificates. This substitution eliminates password transmission risks while maintaining authentication functionality.
2Reliability
If web service applications integrate digital certificate technology for authentication, then authentication security is improved and password policies are simplified, but existing web service applications designed for ID-based authentication fail to recognize certificate-encoded IDs
Solution Approach 1:
The patent segments the authentication information within the digital certificate to extract only the necessary identifier component. The service request filter parses the digital certificate to separate the client identifier from other certificate data (public key, signature, expiration date), and transmits only the identifier to the service provider. This segmentation allows existing ID-based services to receive familiar identifier formats while the full certificate remains available for enhanced security verification.
Solution Approach 2:
The service request filter acts as an intermediary that translates between the digital certificate format and the traditional ID format expected by existing web services. It intercepts service requests, extracts identifiers from certificates, and reformats them into the conventional ID structure, enabling seamless integration without modifying existing service provider code.
3Reliability
If proprietary authentication methods like IBM's WEB IDENTITY or TIVOLI ACCESS MANAGER are used, then access control capabilities are enhanced, but system complexity and overhead increase significantly
Solution Approach 1:
The patent implements a universal authentication framework based on standard digital certificate technology that can serve multiple authentication and authorization functions. Rather than requiring separate proprietary systems for different access control needs, the digital certificate infrastructure provides a single mechanism that handles user identification, authentication, and authorization decisions, reducing overall system complexity while maintaining comprehensive access control capabilities.
Data Source
AI summary
A Centralized Authentication & Authorization (CAA) system that facilitates secure communication between service clients and service providers. CAA comprises a Service Request Filter (SRF), a Service Client Authentication Program (SCAP), a Service Authorization Program (SAP), and an Authorization Database (ADB). The SRF intercepts service requests, extracts the service client's identifier from a digital certificate attached to the request, and stores the identifier in memory accessible to service providers. In the preferred embodiment, the SRF forwards the service request to a web service manager. The web service manager invokes SCAP. SCAP matches the identifier with a record stored in ADB. SAP queries ADB to determine if the service request is valid for the service client. If the service request is valid, SAP authorizes the service request and the appropriate service provider processes the service request.