Client Authentication Using Multiple Non-Delegable Certificates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems using multiple servers for load balancing face security risks due to delegable credentials and complex constrained delegation topologies, which require high skill to configure and are not compatible with mixed configurations or one-way trust resource forests.
Innovation Solution
The use of multiple non-delegable certificates, where a first certificate authenticates a client to a front-end server, and a second certificate is retrieved from a back-end server to authenticate the front-end server, allowing access to data without storing passwords on the device, and enabling authentication across multiple servers without delegation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password credentials are used for authentication, then the authentication process is simple, but security risks increase due to delegable credentials and storage requirements
Solution Approach 1:
The patent segments the authentication credentials into two separate certificates: a service certificate stored on the client device for authenticating to the front-end server, and a resource certificate stored on the back-end server for authenticating resource access. This segmentation eliminates the need to store passwords on the device while maintaining simple authentication processes.
2Adaptability or versatility
If constrained delegation topology is implemented, then authentication across multiple servers is enabled, but system complexity increases and compatibility issues arise
Solution Approach 1:
The patent introduces a front-end server as an intermediary between the client device and the back-end server. The front-end server handles the complex certificate management and authentication to the back-end server, while the client device only needs to present its service certificate. This intermediary approach simplifies the client-side implementation and reduces configuration complexity.
Solution Approach 2:
The system performs preliminary actions by pre-configuring the front-end server with the resource certificate from the back-end server and establishing trust relationships in advance. This allows the client device to authenticate simply by presenting its service certificate without needing to understand or configure the complex back-end authentication mechanisms.
3Ease of operation
If credentials are stored on the device for continuous access, then user convenience is improved, but security risks increase due to device loss or theft
Solution Approach 1:
The patent segments authentication credentials so that only a service certificate (not the resource certificate or password) is stored on the client device. This minimal credential storage provides continuous access convenience while reducing security risks, as the service certificate alone is insufficient to access protected resources without the back-end server's resource certificate.
Data Source
AI summary
Example embodiments provide for authenticating a device to multiple servers without using delegation or having to have a password stored on the device. Multiple certificates that are typically non-delegable are used to authenticate the device to each server. One certificate is used to authenticate the client with the front-end server and a second certificate is used to authenticate the client against a back-end server. Rather than having both certificates reside with the device, however, the second certificate is originally stored by the client in the back-end. It is then retrieved “on-the-fly” by the front-end upon authentication of the client and used to authenticate itself as the client in order to act on behalf of the client when retrieving data from the back-end server.