Distributed Security Authentication via Epoch Key Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems face inefficiencies in authentication and authorization processes, which are resource-intensive and prone to replay attacks, with unauthorized users potentially generating fraudulent data or stealing authentication credentials.
Innovation Solution
A distributed security system that processes requests externally to the network edge, using a processing node to manage authentication and authorization states, encrypt authentication data with epoch keys, and verify user identities through an authority node, minimizing the need for repeated authentication and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security systems perform multiple authentication and authorization checks within the enterprise network, then user access control is maintained, but processing inefficiencies occur and resource consumption increases
Solution Approach 1:
The patent extracts authentication and authorization functionality from the enterprise network interior to an external security service. The security processing is performed outside the enterprise network boundary, with only authentication results and authorization tokens being passed back into the network. This eliminates the need for multiple internal authentication checks and reduces resource consumption within the enterprise infrastructure.
Solution Approach 2:
The system performs authentication and authorization checks in advance before requests enter the enterprise network. Users are authenticated by the external security service beforehand, and their authorization status is determined prior to network access. This preliminary action eliminates the need for repeated authentication during subsequent requests, improving processing efficiency.
2Speed
If authentication and authorization data is stored and reused within the enterprise system, then access speed improves, but the data becomes vulnerable to replay attacks and theft by unauthorized users
Solution Approach 1:
The patent introduces an external security service as an intermediary between users and the enterprise network. This intermediary handles all authentication and authorization data management, keeping sensitive data outside the enterprise network boundary. The intermediary issues temporary authorization tokens that are validated without exposing the underlying authentication data, preventing replay attacks and data theft while maintaining fast access speeds.
Solution Approach 2:
The system segments authentication data and authorization tokens into separate, temporary components. Each authorization token is a discrete, single-use or limited-use credential that does not contain the full authentication data. This segmentation prevents unauthorized users from obtaining complete authentication credentials even if they intercept individual tokens, while still enabling rapid verification through token validation.
3Reliability
If multiple authentication analyses are performed to determine user authorization status, then security reliability is improved, but resource consumption within the enterprise increases
Solution Approach 1:
The patent extracts the resource-intensive authentication analysis processes from the enterprise network to an external security service. The external service performs all computational heavy lifting for authentication and authorization determination, while the enterprise network only needs to validate returned authorization tokens. This extraction maintains security reliability through thorough authentication while dramatically reducing resource consumption within the enterprise infrastructure.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods and apparatus for a distributed security that provides authentication and authorization management. The system can include an epoch processor that is used to validate authentication and authorization data that is valid only for an epoch. The epoch processor can maintain a public key that can be used to decrypt the authentication and authorization data during the epoch that the key is valid. The epoch processor can receive a new public key during each epoch. The epoch processor can also determine if the authentication or authorization data was fraudulently generated based on the contents of the data, and verifying whether the data is valid for the epoch in which it was decrypted.