Cloud On-Premise Authentication Gateway
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional communication authentication between cloud and on-premise applications is poll-based, placing a burden on on-premise applications to detect changes and initiate updates, and lacks effective message authentication, making it vulnerable to unauthorized access.
Innovation Solution
Implementing an authentication mechanism at an application server that receives messages from cloud applications, parses and authenticates them using identification information, and forwards authenticated messages to on-premise applications, thereby shifting the burden from on-premise applications and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If poll-based authentication is used between cloud and on-premise applications, then on-premise applications can detect changes and request updates, but the burden falls on on-premise applications to continuously monitor and initiate communication
Solution Approach 1:
The patent inverts the conventional poll-based architecture by having cloud applications push notifications to on-premise applications through a gateway. Instead of on-premise applications continuously polling cloud applications for changes, the cloud applications initiate communication when changes occur, fundamentally reversing the direction of communication initiation and eliminating the monitoring burden from on-premise applications.
Solution Approach 2:
The patent introduces a gateway as an intermediary component that facilitates secure communication between cloud and on-premise applications. The gateway receives push notifications from cloud applications, authenticates them using stored credentials, and forwards them to the appropriate on-premise applications. This intermediary simplifies the architecture by centralizing authentication logic and eliminating the need for on-premise applications to implement complex polling and authentication mechanisms.
2Reliability
If conventional security techniques such as encryption and firewalls are employed, then communication security is improved, but these techniques do not provide effective message authentication and remain vulnerable to unauthorized access
Solution Approach 1:
The patent implements preliminary action by pre-storing cloud application credentials (client ID, client secret, refresh token) in the gateway before actual communication occurs. When a push notification arrives, the gateway uses these pre-stored credentials to authenticate the message before forwarding it. This preliminary preparation of authentication data enables rapid, secure verification without requiring real-time complex authentication protocols.
Solution Approach 2:
The patent implements feedback mechanisms through authentication verification and error handling. When a cloud application sends a push notification, the gateway verifies the message signature using pre-stored credentials and provides feedback by either forwarding authenticated messages or rejecting unauthorized ones. The system also implements refresh token feedback by obtaining new access tokens when existing ones expire, ensuring continuous authentication capability.
3Speed
If on-premise applications implement continuous monitoring and polling for updates, then they can detect changes promptly, but this increases network traffic and system resource consumption
Solution Approach 1:
The patent replaces continuous periodic polling with event-driven push notifications. Instead of on-premise applications continuously sending requests at fixed intervals, cloud applications send notifications only when actual changes occur. This transforms the communication pattern from periodic waste to event-based efficiency, maintaining speed of update delivery while eliminating the energy waste of unnecessary periodic checks.
Data Source
AI summary
In accordance with embodiments, there are provided methods and systems for providing communication authentication between cloud applications and on-premise applications. A method of embodiments includes receiving, from a cloud application at a cloud computing device, a first message at an application server of a server computing system, and parsing, at the application server, the first message to determine first identification information contained within the first message. The method further includes authenticating, at the application server, the first message by verifying the first identification information, and forwarding the first authenticated message to an on-premise application at a remote computing device.