Flexible Authentication Switching to Short-Lived Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Federated authentication systems are vulnerable to outages at identity providers, leading to service disruptions for relying parties, as they rely heavily on the availability of these providers, and building backup authentication infrastructure increases security risks and complexity.
Innovation Solution
A flexible authentication system that switches between federated and local short-lived bearer token models, allowing relying parties to generate and communicate temporary tokens to users via collected contact information, enabling continued access to online services during identity provider outages without requiring sophisticated authentication infrastructure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If relying parties use federated authentication with identity providers, then user authentication is simplified and account management costs are reduced, but service availability becomes vulnerable to identity provider outages
Solution Approach 1:
The system dynamically changes the authentication parameter from federated authentication to local short-lived bearer token authentication based on the availability of the identity provider. When the identity provider is unavailable, the system switches to issuing local tokens that do not require external validation, thereby maintaining service availability while preserving the simplicity of federated authentication during normal operation
Solution Approach 2:
The authentication system is made dynamic by implementing a fallback mechanism that automatically switches between federated authentication and local short-lived bearer token authentication. This dynamic adaptation allows the system to respond to identity provider outages in real-time, ensuring continuous service availability without requiring users to manually change authentication methods
2Reliability
If relying parties build parallel authentication infrastructure for identity provider outages, then service continuity is maintained, but security risks increase and maintenance effort increases
Solution Approach 1:
The system uses short-lived bearer tokens that are valid only for a limited time and can be discarded after use. These temporary tokens provide a simple, low-cost authentication mechanism during identity provider outages without requiring the maintenance of complex long-term authentication infrastructure. The short-lived nature of these tokens minimizes security risks while maintaining service continuity
Solution Approach 2:
The invention extracts the essential authentication function from the complex federated authentication system and implements it as a standalone local short-lived bearer token mechanism. This extracted authentication capability can operate independently when the identity provider is unavailable, providing service continuity without requiring the full complexity of the federated authentication infrastructure to be maintained in parallel
3Productivity
If identity providers delete user accounts or go out of business, then identity provider resources are optimized, but user access to relying party services is lost
Solution Approach 1:
The system performs preliminary actions by issuing local short-lived bearer tokens to users before the identity provider deletes their accounts or goes out of business. These tokens are generated based on information already collected by the relying party, such as user identifiers. When users present these pre-issued tokens, they can regain access to relying party services even after their identity provider accounts have been deleted, thereby maintaining user access continuity while allowing identity providers to optimize their resources
Data Source
AI summary
A flexible authentication system is described herein that fluidly switches between a federated authentication model and a local short-lived token model that does not require sophisticated authentication infrastructure at the relying party site. Upon detecting an event that causes the identity provider to be unavailable for authentication, the relying party switches to a temporary token model. The system generates a bearer token or challenge associated with the user's identity and (optionally) associated with time data that limits the period during which the token is valid. The relying party communicates the short-lived token to the user using contact information associated with the user and already stored by the relying party. Upon receiving the short-lived token, the user provides the short-lived token to the relying party, and the relying party processes the token to validate the user's identity and then allows the user to access the relying party's online services.