Identity Proxy Session Establishment With Encrypted Passwords
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of plaintext passwords for logging into user accounts leads to security vulnerabilities, as they can be intercepted by malicious actors, and manual management of access policies introduces latency and potential errors.
Innovation Solution
An identity management system provides an encrypted password to a software client or a gateway, establishing sessions on behalf of the user without revealing the plaintext password, and manages access based on generated labels associated with the user and application server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If plaintext passwords are used for logging into user accounts, then ease of operation is improved, but security is worsened due to potential interception by malicious actors
Solution Approach 1:
The patent introduces an identity management system as an intermediary between users and application servers. This system encrypts passwords before they are transmitted to end clients, and manages session tokens separately. The intermediary prevents plaintext passwords from being exposed to malicious actors while still enabling authentication, thus resolving the contradiction between ease of operation and security.
Solution Approach 2:
The patent replaces the mechanical system of plaintext password transmission with cryptographic encryption mechanisms. Instead of directly sending plaintext passwords from users to application servers, the system uses encryption to transform passwords into secure formats, and employs session tokens for subsequent authentication. This substitution eliminates the security vulnerability of plaintext transmission while maintaining operational ease.
2Adaptability or versatility
If manual management of access policies is performed, then adaptability is improved, but productivity is worsened due to latency and potential errors
Solution Approach 1:
The patent implements self-service mechanisms where the identity management system automatically generates session tokens, manages access policies, and handles authentication workflows without requiring manual intervention for each operation. The system autonomously encrypts passwords, creates session identifiers, and manages user access rights, thereby eliminating manual management latency while maintaining adaptability through programmable policy enforcement.
Solution Approach 2:
The patent establishes continuous automated processes for password encryption, session token generation, and access policy enforcement. Once initial access policies are configured, the system continuously and automatically manages authentication and authorization without interruption or manual delays. This continuous automated operation eliminates the productivity losses associated with manual policy management while preserving adaptability through flexible policy definitions.
Data Source
AI summary
A method for managing sessions with an application server via an identity management system is described. The method may include receiving, via an application protocol interface (API) of a cloud service of the identity management system, a first request associated with a first user for user access to an account of the application server. The API may transmit a second request for a secrets service to encrypt a password associated with the first user to a public key of a keypair. The API may receive a message including the encrypted password and forward the encrypted password to an end-client. The identity management system may establish a session on behalf of the first user for the account of the application server based on the end-client having access to a private key of the keypair.