Distributed Authentication via Intermediate Machine Impersonation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems lack the means for servers to authenticate users who authenticate through third-party components, especially when the available credentials do not comply with server requirements, such as when a user has a ticket or certificate but the server only accepts username and password, or when users are in a different security scope.
Innovation Solution
A method and system that involves a client machine authenticating a user to an intermediate machine, which then impersonates the client and requests access to a second domain, with the domain controller authorizing the access and transmitting authentication data to an application server, allowing the client to obtain a launch ticket for accessing resources in the second domain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a user authenticates to a third-party component instead of directly to the server, then the user can maintain security and trust relationships, but the server cannot trust the third-party component to authenticate the user on behalf of the server
Solution Approach 1:
The patent introduces an intermediate machine as a mediator between the client machine and the domain controller. This intermediate machine receives authentication credentials from the client, impersonates the client to the domain controller, and facilitates authentication without requiring the server to directly trust the third-party component. The intermediate machine acts as a bridge that translates third-party authentication into server-acceptable credentials.
2Reliability
If the server accepts only username and password credentials, then the authentication method is simple and reliable, but users with tickets or certificates from third-party components cannot access the server
Solution Approach 1:
The patent transforms the authentication parameter format by converting third-party credentials (tickets, certificates) into server-acceptable username and password credentials through the intermediate machine. The intermediate machine changes the credential parameters to match the server's requirements, enabling users with different credential types to access the server uniformly.
3Adaptability or versatility
If the user is in a different security scope than the server, then the user can access resources from different domains, but the user does not have any credentials acceptable to the server
Solution Approach 1:
The intermediate machine serves as a mediator that bridges different security scopes and domains. It receives credentials from users in one domain and translates them into credentials acceptable to the server in another domain, enabling cross-domain access while maintaining credential compatibility through the intermediate authentication layer.
Data Source
AI summary
A method for facilitating distributed authentication includes the step of requesting, by a user of a client machine residing in a first domain, access to a resource residing in a second domain. The client machine authenticates the user to an intermediate machine. The intermediate machine impersonates the client machine. The intermediate machine impersonating the client machine requests access to the second domain from a domain controller residing in the second domain. The domain controller authorizes the requested access, responsive to a determination that the impersonated client machine is trusted for delegation. The domain controller transmits to an application server residing in the second domain, authentication data associated with the impersonated client machine. The application server transmits, to the intermediate machine, a launch ticket uniquely identifying a logon token. The client machine provides, to the application server, the launch ticket to access the resource residing in the second domain.