Secure Credential Hash Synchronization Between On-Premises and Cloud
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large organizations face challenges in securely synchronizing on-premises credentials with cloud services without exposing sensitive data, while smaller organizations lack the resources to implement and maintain federation services for unified access.
Innovation Solution
A password synchronization technology that uses hash values computed from plaintext passwords, processed into secondary hash-protected blobs, allowing secure synchronization between on-premises and cloud directory services without exposing plaintext passwords, and enabling easy switching between hashing algorithms without user intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If plaintext passwords are replicated to cloud directory service, then credential synchronization is achieved, but security is compromised
Solution Approach 1:
The patent extracts only the essential credential information (hash values) needed for authentication while leaving out the sensitive plaintext passwords. The synchronization process transmits only password hashes and salt values from on-premises Active Directory to Azure AD, eliminating the security risk of transmitting or storing plaintext passwords in the cloud.
Solution Approach 2:
The patent introduces hash functions and salt values as intermediaries between the plaintext password and the synchronized credential data. The password hash serves as a mediator that preserves authentication functionality while protecting the original password from exposure during synchronization.
2Ease of operation
If federation service is implemented for unified access, then single sign-on is achieved, but installation and maintenance cost increases significantly
Solution Approach 1:
The patent replaces the expensive, complex federation infrastructure with a simpler, more economical credential synchronization approach. Instead of implementing full federation services requiring multiple servers and complex configurations, the solution uses straightforward password hash synchronization that can be implemented with minimal infrastructure.
Solution Approach 2:
The patent extracts only the essential authentication credential synchronization functionality from the complex federation service, leaving out the unnecessary complexity of full federation implementation while retaining the core benefit of unified access.
3Ease of operation
If password interception method is used for synchronization, then credential sync is achieved, but software configuration complexity increases on each server
Solution Approach 1:
The patent merges the password synchronization functionality into the existing Active Directory domain controller infrastructure, leveraging the existing replication mechanism. Instead of requiring separate software configuration on each server, the synchronization is achieved by extending the existing AD replication to include password hashes and salt values.
4Reliability
If multiple credential sets are issued for on-premises and cloud access, then authentication is enabled, but credential management complexity increases
Solution Approach 1:
The patent makes the synchronized password hash universally applicable for both on-premises Active Directory authentication and Azure AD authentication. Instead of requiring separate credential sets for different environments, the same password hash serves both purposes, simplifying credential management while maintaining authentication reliability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The subject disclosure is directed towards securely synchronizing passwords that are changed at a source location (e.g., an on-premises directory service) to a target location (e.g., a cloud directory service), so that the same credentials may be used to log into the source or target location, yet without necessarily having each domain controller handle the synchronization. The plaintext password is not revealed, instead using hash values computed therefrom to represent the password-related data. The target may receive a secondary hash of a primary hash, and thereby only receive and store a password blob. Authentication is accomplished by using the same hashing algorithms at the target service to compute a blob and compare against the synchronized blob. Also described are crypto agility and/or changing hashing algorithms without requiring a user password change.