Federated Identity Protocol for Strong Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for implementing strong authentication in enterprises require significant development resources and overhead, as they necessitate the creation of proprietary APIs and modifications to database schemas and user interfaces to integrate second-factor authentication.
Innovation Solution
A system utilizing a federated identity protocol that allows for seamless integration of strong authentication by searching for and verifying virtual tokens associated with user identifiers, eliminating the need for proprietary APIs and database schema modifications, and enabling silent authentication without user input.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If proprietary APIs are developed to integrate strong authentication service provider, then strong authentication capability is achieved, but development time and resources increase
Solution Approach 1:
The patent implements a universal authentication framework that supports multiple authentication types (password, biometric, hardware token, software token) through a common interface. This allows enterprises to integrate strong authentication capabilities once and reuse them across multiple applications and users, eliminating the need to develop proprietary APIs for each authentication type separately.
Solution Approach 2:
The patent introduces an authentication service provider as an intermediary component that sits between the enterprise application and various authentication mechanisms. This mediator handles the complexity of different authentication types, presenting a unified interface to applications while managing diverse authentication backends, thereby reducing development effort.
2Adaptability or versatility
If database schema modifications are made to support second-factor authentication, then authentication data storage capability is improved, but system complexity and overhead increase
Solution Approach 1:
The patent segments the authentication data storage into separate modules: user credentials are stored in the existing enterprise database, while authentication factors (biometric data, token information) are stored in dedicated authentication databases. This segmentation allows adding second-factor authentication capabilities without modifying the core enterprise database schema, reducing system complexity.
Solution Approach 2:
The authentication service provider acts as an intermediary layer that manages complex authentication data storage requirements. It handles mapping between user identifiers and various authentication factors, verifying credentials, and provisioning certificates without requiring changes to existing enterprise database schemas.
3Reliability
If front-end application user interfaces are modified to support second-factor authentication, then user authentication capability is enhanced, but implementation overhead and development resources increase
Solution Approach 1:
The patent uses the authentication service provider as an intermediary that handles authentication UI logic centrally. The service provider can present authentication challenges (password prompts, biometric scans, token verification) and manage the authentication flow, reducing the need to modify front-end application user interfaces for each authentication type.
Solution Approach 2:
The authentication service provider implements a universal authentication interface that can handle multiple authentication types through a single standardized interaction model. This allows existing user interfaces to work with different authentication methods without requiring separate UI implementations for each authentication type.
4Speed
If virtual tokens are requested without user notification, then authentication speed is improved, but user awareness and control are reduced
Solution Approach 1:
The patent implements preliminary action by pre-provisioning virtual tokens (such as biometric data or hardware token credentials) on user devices during initial setup or enrollment. When authentication is needed, the system can quickly retrieve and use these pre-configured tokens without requiring real-time user input or notification, thereby speeding up authentication while maintaining security through prior user consent during enrollment.
Data Source
AI summary
A computing system of an authentication service provider receives a federated identity protocol request triggered by a relying party to validate a user. The federated identity protocol request includes a user identifier of an authenticated identity. The computing system searches mapping data stored in a data store that is coupled to the computing system to identify a type of virtual token associated with the user identifier and authenticates the user by requesting the identified type of virtual token from a user device and verifying a virtual token received from the user device using the mapping data. The computing system sends second-factor authentication results to the relying party via the federated identity protocol.