Federated Authentication Proxy for Multi-Protocol Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems are limited by the security level of a single identity provider (IdP), which restricts authentication security and do not allow for easy integration of additional security factors, especially in environments where multiple authentication protocols are used.
Innovation Solution
A federated authentication proxy system that acts as an intermediary between service providers (SP) and identity providers (IdP), enabling the use of multiple authentication protocols and adding a secondary layer of authentication, such as two-factor authentication, without requiring re-architecture of existing systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a service provider configures a single identity provider (IdP) for authentication delegation, then the system implementation is simple and straightforward, but the authentication security is limited to the security level of that single IdP and cannot easily integrate additional security factors
Solution Approach 1:
The patent introduces a proxy identity provider as an intermediary component between the service provider and the actual identity provider. This proxy acts as a mediator that can add secondary authentication factors (such as two-factor authentication) while the service provider continues to communicate with it as if it were the actual IdP. The proxy intercepts authentication requests, adds additional security layers, and then forwards requests to the underlying IdP, thereby enhancing security without requiring the service provider to re-architecture its system.
Solution Approach 2:
The authentication system is segmented into multiple independent components: the service provider, the proxy identity provider, and the actual identity provider. This segmentation allows each component to have specialized functions - the service provider handles service logic, the proxy handles security enhancement and protocol translation, and the actual IdP handles user credential verification. This modular architecture enables flexible security enhancement without coupling the service provider to specific security implementations.
2Adaptability or versatility
If a service provider uses a single authentication protocol with an identity provider, then the integration is straightforward, but the system cannot support multiple authentication protocols and lacks flexibility
Solution Approach 1:
The proxy identity provider is designed with multi-functionality to support multiple authentication protocols (SAML, OpenID Connect, and others). It can translate between different protocols, allowing the service provider to use a single proxy interface while the proxy itself handles multiple protocol types. This enables the system to adapt to different authentication standards without requiring the service provider to implement multiple separate integration paths.
Solution Approach 2:
The proxy serves as a protocol translation intermediary that sits between the service provider and various identity providers using different authentication protocols. It receives requests from the service provider in one protocol format, translates them to the appropriate protocol for the target IdP, and translates responses back. This mediator approach allows the service provider to maintain simple integration while the system gains support for multiple authentication protocols through the proxy's translation capabilities.
Data Source
AI summary
A system and method that include receiving a service provider identity request through a protocol; transmitting a proxy identity request to a configured identity provider; receiving an identity assertion; determining a proxy identity assertion based on the identity assertion; and transmitting the proxy identity assertion to the service provider.