Dynamic Proxied Credential Reset for Enterprise Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack efficient dynamic management and secure reset of user credentials for accessing multiple services across enterprise and external networks, leading to potential security vulnerabilities and administrative complexities.
Innovation Solution
A method involving a proxy server that authenticates users, facilitates access to various services using single sign-on credentials, dynamically modifies credentials after each session, and monitors or records user activities to ensure secure and controlled access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static credentials are used for user authentication across multiple services, then ease of operation is improved, but security is worsened due to potential credential reuse and interception vulnerabilities
Solution Approach 1:
The patent implements dynamic credential generation where temporary credentials are created for each service session rather than using static credentials. The credential generation system creates unique credentials dynamically based on service identifiers and session information, ensuring that credentials change with each interaction and cannot be reused across different services or time periods.
Solution Approach 2:
The system uses temporary, single-use credentials that are discarded after the service session ends. These short-living credentials are generated on-demand for each service access and automatically invalidated after use, preventing long-term credential exposure and reuse vulnerabilities while maintaining convenient single-sign-on access during the active session.
2Object-affected harmful factors
If dynamic credential modification is implemented after each session, then security is improved by preventing credential reuse, but device complexity increases due to additional credential management mechanisms
Solution Approach 1:
The patent introduces a credential generation system as an intermediary component that sits between the user authentication system and the various services. This intermediary automatically handles credential creation, modification, and invalidation based on service requirements and session state, shielding the complexity of dynamic credential management from the user and simplifying the overall system architecture.
Solution Approach 2:
The credential management system performs self-service operations by automatically generating, modifying, and invalidating credentials based on predefined policies and session state. The system monitors service connections and autonomously updates credentials without requiring manual intervention or complex administrative processes, reducing operational complexity while maintaining security.
3Ease of operation
If single sign-on credentials are used for multiple services, then ease of operation is improved, but reliability is worsened due to potential credential interception and reuse attacks
Solution Approach 1:
The patent segments the credential space by creating separate, service-specific credential sets rather than using a single universal credential. Each service receives dedicated temporary credentials that are isolated from other services, preventing cross-service credential leakage and ensuring that compromise of one service's credentials does not affect access to other services.
Solution Approach 2:
The system implements periodic credential rotation where credentials are regenerated at regular intervals or after each service session. This periodic action ensures that credentials remain valid only for the current session and automatically become invalid afterward, preventing long-term credential exposure and ensuring reliable security across multiple service access points.
Data Source
AI summary
A method includes receiving, at a server, a request from a user to access an enterprise network system. The user is authenticated at the server, by receiving first unique credentials from the user. The user's access to a plurality of services external to the enterprise network system is facilitated, in response to receiving the first unique credentials from the user. Each of the plurality of services requires respective unique services credentials associated with the user, to access a respective unique account associated with the user. The method includes receiving, from the user, a selection of one of the plurality of services. The respective unique services credentials associated with the user are determined, for the selected one of the plurality of services. A connection between the server and the selected one of the plurality of services is established, using the respective unique services credentials associated with the user. The user is provided with access to the selected one of the plurality of services during a first session, through the connection between the server and the selected one of the plurality of services. The respective unique services credentials associated with the user are dynamically modified, after the first session is finished.