Federated Authentication Server Intermediary Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing federated authentication systems, such as OpenID Connect, may be inadequate for meeting the specific requirements of resource servers, particularly in managing user authentication and token management efficiently.
Innovation Solution
A federated authentication server is configured to cooperate with an authentication server, featuring an authentication information transmission unit, token reception unit, code issuance unit, storage unit, and token transmission unit to manage user authentication and token storage, enabling seamless authentication and access to resource servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a resource server uses a standard federated authentication service like OpenID Connect, then the resource server can focus on developing its own service without preparing its own authentication service, but the federated authentication function may be inadequate depending on the specific requirements of the resource server
Solution Approach 1:
The patent introduces a federated authentication server as an intermediary component between the authentication server and the resource server. This intermediary extends the standard OpenID Connect flow by adding custom functionality: it intercepts authentication requests, communicates with the authentication server using standard protocols, and then provides customized authentication logic and token management specific to the resource server's requirements. This allows the resource server to maintain its service development focus while obtaining tailored authentication capabilities through the intermediary layer.
2Ease of operation
If authentication information is transmitted to an external authentication system and stored in association with address information, then authentication can be performed externally, but the system lacks the ability to issue and manage custom codes for identifying authentication success responses
Solution Approach 1:
The patent merges the standard OpenID Connect authentication flow with a custom code issuance and verification mechanism. The federated authentication server combines the external authentication capability (transmitting authentication information to the authentication server) with an internal code management system (issuing codes for authentication success responses). This integration allows the system to maintain ease of external authentication while adding custom code management capabilities, as the federated authentication server handles both functions in a unified manner.
3Reliability
If a token is received from the authentication server for use in accessing the resource server, then user authentication is enabled, but there is no mechanism to securely store and manage the association between authentication codes and tokens
Solution Approach 1:
The patent implements preliminary action by having the federated authentication server store the association between authentication codes and tokens in advance, before actual resource access occurs. When the authentication server returns a token, the federated authentication server immediately stores it in association with the authentication code in its storage unit. This preliminary storage ensures that when the resource server later needs to verify authentication or access resources, the token-code association is already securely established and available, enhancing reliability without adding complexity during the actual access operation.
Data Source
AI summary
A federated authentication server provides, in cooperation with an authentication server, a function of authenticating a user terminal to a resource server configured to provide a service to the user terminal, and includes an authentication information transmission unit configured to transmit authentication information about a user of the user terminal to the authentication server, a token reception unit configured to receive, from the authentication server, a token for use in accessing the resource server from the user terminal, a code issue unit configured to issue a code for identifying an authentication success response and transmit the code to the resource server, a storage unit configured to store the code and the token in association with each other, and a token transmission unit configured to transmit the token associated with the code to the resource server in a case where the code is transmitted from the resource server.