Cookie State Propagation in Multi-Tenant Identity Cloud
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity management systems in cloud environments face challenges in providing secure access across diverse devices and user types, with inconsistencies in security between on-premise and cloud environments leading to potential security breaches, especially when managing access for employees, customers, and partners.
Innovation Solution
The implementation of a cloud-based identity management system using a multi-tenant, microservices architecture that propagates information through cookies while stripping sensitive data to prevent unauthorized access, providing unified security controls and Single Sign-On (SSO) functionality across various applications and channels, ensuring secure access and consistent security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cookies are used to propagate state information between authentication layers, then access management across multiple channels is enabled, but sensitive data may be exposed in the browser
Solution Approach 1:
The patent extracts sensitive authentication state information from the cookie and relocates it to a query parameter in the redirect URL. This separation ensures that while the cookie maintains necessary state for access management across channels, the sensitive authentication details are stored in a more secure location that does not persist in the browser, thus resolving the contradiction between versatility and data exposure.
Solution Approach 2:
The patent introduces an intermediary mechanism where the authentication service acts as a mediator between the browser and the authentication layers. The service manages the cookie lifecycle and controls what information is stored where, preventing direct exposure of sensitive data in the browser while enabling cross-channel access management through coordinated redirects and state propagation.
2Duration of action of stationary object
If authentication state is stored in cookies on the browser, then user access can be maintained across sessions, but security is compromised due to browser storage vulnerabilities
Solution Approach 1:
The patent implements dynamic state management where authentication information is not statically stored in cookies but is actively managed through a lifecycle of creation, redirection, and expiration. The system dynamically adjusts what information is stored in cookies versus query parameters based on the authentication flow stage, maintaining session persistence while minimizing security risks through dynamic control of data placement.
Solution Approach 2:
The patent performs preliminary actions by creating authentication cookies at specific points in the flow and immediately redirecting to updated URLs that contain the necessary state information as query parameters. This preliminary setup ensures that sensitive data is not left in the browser long-term, as the system proactively moves and updates state information before potential security threats can exploit static cookie storage.
3Ease of operation
If sensitive data is included in cookies for authentication, then authentication functionality is simplified, but unauthorized access becomes more likely
Solution Approach 1:
The patent segments authentication data into different components with different security characteristics. Non-sensitive state information is stored in cookies for ease of operation and simple authentication functionality, while sensitive authentication credentials and state are placed in query parameters or managed server-side. This segmentation maintains operational simplicity for the authentication process while reducing the harmful effects of unauthorized access by limiting the sensitivity of data stored in browser cookies.
Data Source
AI summary
Embodiments provide cloud based identity management to authenticate a user. At a first authentication layer, embodiments receive a request from the user to be authenticated, where the request is received from a browser application on a user computer, and create at least one cookie, where the cookie includes state information of the request and is adapted to be stored on the browser application. At the first authentication layer, embodiments first redirect the request to a second authentication layer. At the second authentication layer, embodiments receive the cookie from the browser application and authenticate the user, and second redirect the request to the first authentication layer, where the second redirecting includes providing a result of the authenticating as a query parameter.