Generating IDP for Secure Multi-Access Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user access management systems expose passwords during authentication, compromising security, especially when using secure sockets layer, and federated identities may not provide end-user passwords to back-end servers.
Innovation Solution
Implementing a generating Identity Provider (IDP) that creates one-time, limited-lifetime user credentials, such as LDAP names and passwords, which are used for authentication instead of real credentials, and can be transmitted to back-end servers via an LDAP or SQL connection, ensuring secure authentication without exposing original credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If original user credentials (passwords) are transmitted to back-end servers for authentication, then authentication can be performed, but security is compromised because passwords are exposed to monitoring devices
Solution Approach 1:
The patent introduces an Identity Provider (IDP) as an intermediary between the user and back-end servers. The IDP receives original credentials from the user, validates them, and then issues generated credentials to back-end servers without exposing the original password. This mediator architecture allows authentication to proceed while keeping the actual password confidential.
Solution Approach 2:
The system creates a copy of the authentication function using generated credentials that replicate the validity and authority of original credentials without containing the actual password. These generated credentials (such as tokens or alternative authentication data) serve as functional substitutes that can be transmitted safely to back-end servers.
2Ease of operation
If federated identity is used for authentication, then single sign-on experience is provided, but end-user passwords are not available to back-end servers requiring credential access
Solution Approach 1:
The IDP acts as a mediator that bridges federated identity authentication with back-end server requirements. When a user authenticates through federated identity, the IDP captures this authentication event and generates appropriate credentials that back-end servers can use, translating between different authentication domains without requiring password sharing.
Solution Approach 2:
The system extracts the authentication proof from the federated identity process and separates it from the actual password. The IDP extracts the validation that the user is authenticated and creates standalone generated credentials that contain only the necessary authentication information without the password itself.
3Reliability
If original credentials are transmitted over network connections, then authentication can be performed, but the credentials are vulnerable to interception even with secure sockets layer
Solution Approach 1:
Instead of transmitting original credentials over the network, the system transmits generated credentials that are functional copies for authentication purposes only. These generated credentials can be designed to be more resistant to interception and can be invalidated if compromised, without affecting the original credentials stored securely.
Solution Approach 2:
The generated credentials can be designed as short-lived, disposable authentication tokens that are valid only for a specific session or time period. If intercepted, their limited validity window minimizes the damage, and they can be regenerated without affecting the user's long-term authentication credentials.
Data Source
AI summary
Apparatus, systems, and methods may operate to receive, at a generating identity provider (IDP), original user credentials sufficient to authenticate a user directly from a user machine, or indirectly from an initial identity provider. Additional activities may include generating, by the generating IDP, generated user credentials having the lifetime of a login session associated with the user, the lifetime initiated approximately when the original user credentials or a token associated with the user are/is validated at the generating IDP. Still further activities may include receiving a request associated with the user during the login session to access an application protected by an agent, and transmitting at least part of the generated user credentials from the generating IDP to the application to authenticate the user to the generating IDP while the login session is not terminated or expired. Additional apparatus, systems, and methods are disclosed.