Client Device Dynamic Authentication Routing to Backup System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Authentication systems often experience outages, preventing principals from maintaining access to resources after their authentication artifacts expire, as they cannot dynamically route requests to backup systems during primary system failures.
Innovation Solution
A client device dynamically routes authentication requests to a backup authentication system if the primary system fails to respond, using a stored list of authorized authentication systems and an authentication package received from the primary system to ensure continuous access to resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single primary authentication system is used, then the system structure is simple, but the system availability deteriorates during outages
Solution Approach 1:
The authentication system is segmented into a primary authentication system and one or more backup authentication systems. The client device maintains a list of authorized authentication systems and can dynamically route authentication requests to either the primary or backup systems based on their operational status, thereby improving availability while maintaining manageable system complexity through modular architecture.
Solution Approach 2:
The client device stores a list of authorized authentication systems (including backup systems) in advance before any outage occurs. This preliminary action enables the client to immediately switch to a backup system when the primary system becomes unavailable, without requiring complex real-time discovery or configuration changes, thus resolving the contradiction between simple structure and high availability.
2Reliability
If authentication requests are routed to backup systems during outages, then system availability improves, but the routing complexity increases
Solution Approach 1:
The client device pre-stores a list of authorized authentication systems (including backup systems) before any outage occurs. This eliminates the need for complex real-time routing logic, as the client simply compares the primary system's operational status against the pre-stored list and routes to an appropriate system based on this simple lookup, thereby maintaining low routing complexity while achieving high availability.
Solution Approach 2:
The pre-stored list of authorized authentication systems acts as an intermediary that simplifies the routing decision-making process. Instead of implementing complex routing algorithms, the client uses this intermediary list to quickly determine whether to use the primary or backup system, reducing routing logic complexity while ensuring availability.
3Reliability
If the client device stores a list of authorized authentication systems, then the ability to switch during outages improves, but the memory consumption increases
Solution Approach 1:
The client device stores only the essential information needed for failover - a list of authorized authentication system identifiers - rather than storing complete system configurations or large amounts of authentication data. This partial storage approach provides sufficient failover capability while minimizing memory consumption, resolving the contradiction between reliability and resource usage.
Data Source
AI summary
Techniques are described herein that are capable of dynamically routing an authentication request to a backup authentication system by a client device. For instance, the client device stores a list, which identifies authentication systems that are authorized to respond to authentication requests from the client device. The client device sends the authentication request toward a primary authentication system based at least in part on the authentication request identifying the primary authentication system as a recipient of the authentication request. The authentication request requests authentication of a principal by the primary authentication system. The client device causes the backup authentication system to authenticate the principal using an authentication package received from the primary authentication system by dynamically routing the authentication request to the backup authentication system based at least in part on not receiving a valid response to the authentication request and further based at least in part on the list.