Federated Identity Account Revocation via Blockchain Ledger
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In federated identity management (FIdM), there is a challenge in securely and efficiently deleting user accounts from service providers (SPs) when they are revoked by identity providers (IdPs, as orphaned profiles consume resources and pose security risks, and existing methods lack a trusted and efficient mechanism for consistent account revocation.
Innovation Solution
Implementing a blockchain-based system where the IdP publishes revocation information, allowing the SP to delete corresponding user accounts and publish acknowledgments, ensuring secure and efficient communication and storage of account status through an immutable ledger.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional account revocation methods are used in federated identity management, then the service provider can delete user accounts, but the revocation process lacks trustworthiness and consistency, leading to orphaned profiles that consume resources and pose security risks
Solution Approach 1:
The patent introduces a blockchain as an intermediary mediator between the identity provider and service provider. The blockchain ledger stores cryptographic proofs of account revocation that both parties can trust without direct communication. This intermediary mechanism ensures reliable and consistent account revocation while maintaining system security and preventing orphaned profiles.
2Manufacturing precision
If the service provider continuously monitors for revocation information, then account revocation consistency is improved, but system overhead and processing time increase
Solution Approach 1:
The patent implements preliminary action by having the identity provider publish account revocation information to the blockchain ledger in advance, before the service provider needs to verify it. The blockchain is continuously updated with cryptographic proofs, so when the service provider checks the ledger, the revocation information is already available and verified, eliminating the need for continuous monitoring and reducing processing time.
3Reliability
If cryptographic proofs are stored on a blockchain ledger, then revocation verification security is improved, but storage requirements and computational overhead increase
Solution Approach 1:
The patent applies the extraction principle by removing the need to store complete account information on the blockchain. Instead, only essential cryptographic proofs (hashes and signatures) are stored on the blockchain ledger, while the actual account data remains distributed across the federated identity management system. This extraction of only the necessary verification elements reduces storage requirements and computational overhead while maintaining security.
Data Source
AI summary
A service provider configured to establish a federated identity management with an identity provider, provision a first user account, and retrieve revocation information from a ledger. The revocation information can include a revoked user account identifier published to the ledger by the identity provider. The service provider can determine that the revoked user account identifier corresponds to the first user account. The service provider can delete the first user account from the service provider.