Credential Translation Intermediary for On-Premises Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Authentication servers often do not support various types of credentials, leading to user inconvenience, inefficiency, and security risks due to reliance on password-based credentials.
Innovation Solution
A client device authenticates with a second authentication server that supports the provided credential type, generating an encrypted user token which is then used to authorize access to network resources controlled by the initial authentication server, allowing the use of hardware or biometric credentials and reducing reliance on passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If an authentication server only supports password credentials, then the device complexity is reduced, but the security reliability deteriorates and user frustration increases
Solution Approach 1:
The patent introduces a credential translation intermediary that converts unsupported credential types into supported formats. When a client presents an unsupported credential (e.g., hardware key), the system uses a mediator service to translate it into a supported credential type (e.g., password or token) that the authentication server can process, thereby maintaining security without requiring the server to support multiple credential types directly
Solution Approach 2:
The authentication system is enhanced with multi-functionality to handle multiple credential types through a unified interface. The server maintains its simple architecture while gaining the ability to authenticate various credential types via credential translation and adaptation layers, allowing it to function universally across different authentication methods without increasing inherent complexity
2Adaptability or versatility
If multiple credential types are supported across different networks, then the adaptability improves, but the device complexity and computing resources increase
Solution Approach 1:
The patent extracts the complexity of multi-credential management from the client device and places it on the server side. The client simply presents any credential type it has, while the server-side credential translation service handles the complexity of adapting different credential types to the required format, thereby maintaining adaptability without burdening the client device
Solution Approach 2:
A server-side intermediary service is introduced to manage credential translation between different types. This mediator handles the complexity of converting between credential formats (hardware keys, biometrics, passwords) and the formats required by specific authentication servers, allowing clients to use any credential type without managing multiple credential sets
3Ease of operation
If password credentials are used, then the ease of operation improves, but the security reliability deteriorates
Solution Approach 1:
The patent creates a mapping or copy relationship between secure credentials (hardware keys, biometrics) and traditional password credentials. The secure credential authenticates the user, and the system creates a corresponding password-based token or representation that the authentication server can verify, allowing secure credentials to function as easily as passwords without compromising security
Solution Approach 2:
The patent substitutes modern cryptographic authentication mechanisms (hardware keys, biometric verification) for traditional password-based mechanical authentication. These newer mechanisms provide superior security while maintaining ease of operation through automated enrollment and verification processes that replace manual password management
4Adaptability or versatility
If a client device uses unsupported credential types, then the adaptability improves, but the productivity deteriorates due to failed authentication
Solution Approach 1:
The patent introduces an intermediary credential translation service that sits between the client and authentication server. When a client presents an unsupported credential type, the intermediary automatically translates it into a supported format, ensuring authentication success without requiring the client to know which credential type to use or risking failed authentication
Solution Approach 2:
The system performs preliminary credential validation and translation before the actual authentication attempt reaches the target server. By pre-processing the credential through translation and adaptation, the system ensures that the credential will be accepted, preventing authentication failures and maintaining high productivity
Data Source
AI summary
An authentication server may not support all types of user credentials. For example, an on-premise authentication server may support credentials based on user secrets (i.e. username and password) and certificate-based credentials, but not hardware-key based credentials. A client device may use an un-supported type of credential to access resources managed by the on-premise authentication server by authenticating with a web-based authentication server. The web-based authentication server may support any type of credential, and the supported types of credentials may change over time. The web-based authentication server returns an authenticated user token indicating the user has been authenticated, but without authorizing access to any resources. The client device uses the on-premise authentication server to exchange the authenticated user token for an authorized user token. The client device then uses the authorized user token to access resources on the on-premise network.