Identity Bridge Authentication for Hybrid Multi-Tenant Cloud IAM
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity management systems struggle to provide secure and unified access to cloud-based applications across hybrid environments, including both public and private clouds, while ensuring consistent security measures for various user types and channels, and integrating with on-premise authentication systems.
Innovation Solution
A multi-tenant identity cloud service with a microservices-based architecture that leverages an in-memory data grid cache callback to optimize authentication flows, supports secure access across hybrid deployments, and integrates with on-premise systems using a bridge, providing unified identity and access management through a cloud-scale IAM platform.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional identity management systems are used in cloud environments, then security measures can be implemented, but the system complexity increases and integration with on-premise systems becomes difficult
Solution Approach 1:
The patent introduces an Identity Bridge as an intermediary component that mediates between on-premise Active Directory and cloud-based identity management systems. This bridge handles authentication token exchange and protocol translation, enabling secure integration without requiring direct complex connections between the on-premise and cloud systems, thus reducing overall system complexity while maintaining security.
Solution Approach 2:
The system is segmented into distinct functional components: on-premise Active Directory, Identity Bridge, and cloud-based identity management service. This segmentation allows each component to operate independently with well-defined interfaces, making the system more manageable and easier to integrate while maintaining comprehensive security controls across the hybrid environment.
2Reliability
If authentication actions are performed synchronously with on-premise systems, then security is maintained, but authentication latency increases
Solution Approach 1:
The system performs preliminary actions by pre-establishing trust relationships and caching authentication tokens between the Identity Bridge and cloud systems. When authentication requests arrive, the system can retrieve pre-cached tokens and validation results, reducing the need for real-time synchronous calls to on-premise systems and thereby decreasing authentication latency while maintaining security.
Solution Approach 2:
The system implements feedback mechanisms where authentication results and token validity information are cached and returned to cloud systems. This feedback loop allows the cloud system to make authentication decisions based on pre-validated information from on-premise systems, reducing round-trip times and latency while ensuring security through continuous validation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments are directed to a multi-tenant cloud system. Embodiments receive a request for an authentication action for a user and create an authenticate target action. Embodiments register a cache listener to listen for a target action response that is responsive to the authenticate target action and initiate the authentication action for the user at an on-premise active directory ("AD") via a bridge. Embodiments wait for a cache callback and, at the cache callback, receive a target action response comprising a result of the authentication action.