Hybrid Authentication System for Cloud-On-Premises SSO
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems lack a secure and fine-grained integration between cloud-based services and on-premises systems, requiring separate authentication processes for users accessing cloud-based services and on-premises systems.
Innovation Solution
Hybrid authentication systems and methods that enable seamless single sign-on (SSO) between cloud-based services and on-premises systems by leveraging an on-premises identity management system and using secure tunneling capabilities to perform user authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate authentication processes are used for cloud-based services and on-premises systems, then security can be maintained for each system, but user management complexity increases and authentication time is lost
Solution Approach 1:
The patent merges cloud-based authentication and on-premises authentication into a unified hybrid authentication system. The authentication service receives credentials, validates them against both cloud and on-premises identity stores, and returns a single authentication result, eliminating the need for separate authentication processes while maintaining security for both systems
Solution Approach 2:
The authentication service is designed to handle multiple authentication scenarios (cloud-only, on-premises-only, and hybrid authentication) through a single unified interface. It can authenticate users against different identity stores based on the authentication type specified, making the system universally applicable to various deployment scenarios
2Reliability
If users authenticate separately to cloud-based services and on-premises systems, then each system can verify credentials independently, but user productivity decreases due to multiple login processes
Solution Approach 1:
The patent combines multiple credential verification operations into a single authentication request. The authentication service simultaneously validates credentials against cloud identity stores and on-premises identity stores, returning a unified authentication result that proves the user's identity across both systems in one operation
Solution Approach 2:
The system performs preliminary validation of authentication types and configures the appropriate verification sequence before actual credential checking. It determines in advance whether cloud authentication, on-premises authentication, or hybrid authentication should be performed, optimizing the verification process before it begins
3Ease of operation
If on-premises systems require port opening through firewall for external access, then external devices can authenticate with on-premises systems, but network security is compromised
Solution Approach 1:
The patent introduces an authentication service as an intermediary between external users and on-premises systems. This service receives authentication requests from external devices, validates credentials through secure channels, and returns authentication results without requiring direct network access to on-premises systems, thus maintaining firewall security while enabling external access
Solution Approach 2:
The system segments the authentication process into distinct components: credential collection, validation against multiple identity stores, and result return. This segmentation allows the authentication service to handle external authentication requests without exposing the on-premises systems directly to external networks, maintaining security boundaries while enabling access
4Adaptability or versatility
If cloud-based services integrate with on-premises identity management systems, then a common user identity can be established, but system complexity and integration difficulty increase
Solution Approach 1:
The authentication service implements a universal authentication interface that can work with multiple types of identity management systems (cloud-based and on-premises). It handles different authentication types (cloud authentication, on-premises authentication, hybrid authentication) through a single unified process, eliminating the need for separate integration mechanisms
Solution Approach 2:
The authentication service acts as an intermediary layer between cloud-based services and on-premises identity management systems. It translates authentication requests into appropriate verification operations against different identity stores and returns unified authentication results, simplifying the integration complexity while establishing common user identity
Data Source
AI summary
Disclosed are hybrid authentication systems and methods that enable users to seamlessly sign-on between cloud-based services and on-premises systems. A cloud-based authentication service receives login credentials from a user and delegates authentication to an on-premises authentication service proxy. The login credentials can be passed by the cloud-based authentication service to the on-premises authentication service proxy, for instance, as an access token in an authentication header. The access token can be a JavaScript Object Notation (JSON) Web Token (JWT) token that is digitally signed using JSON Web Signature. Some embodiments utilize a tunnel connection through which the cloud-based authentication service communicates with the on-premises authentication service proxy. Some embodiments leverage an on-premises identity management system for user management and authentication. In this way, there is no need for a cloud-based system to separately maintain and manage a user identity management system and/or having to sync with an on-premises identity management system.