Ingress Certificate Verification for Resilient Two-Factor Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing two-factor authentication systems are vulnerable to malicious attacks that cause sudden increases in authentication requests, leading to resource waste and service crashes due to invalid certificates.
Innovation Solution
Implementing a root certificate into a two-factor service and configuring an Ingress object to verify the trustworthiness of user certificates at the front end, intercepting and rejecting untrustworthy requests before they reach the back end.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a separate two-factor authentication function is provided at the back end and clients initiate authentication requests carrying certificates, then two-factor authentication can be performed, but the number of authentication requests may increase suddenly during attacks causing service crashing and resource waste
Solution Approach 1:
The patent implements preliminary action by configuring the Ingress object with the root certificate in advance, before any authentication requests arrive. This allows the system to pre-establish the trust relationship and verification rules at the network entry point, enabling immediate rejection of requests with invalid certificates without requiring back-end verification logic to handle these attacks.
Solution Approach 2:
The patent introduces the Ingress object as an intermediary component between clients and the back-end two-factor authentication service. This intermediary performs certificate verification using the configured root certificate, filtering out malicious requests with invalid certificates before they reach the back-end service, thus protecting the service from attacks while maintaining legitimate authentication functionality.
2Productivity
If request queue technology is used to store authentication requests for peak clipping, then transient pressure on the two-factor service is relieved, but numerous authentication requests carrying invalid certificates still reach the back end causing resource waste
Solution Approach 1:
The patent extracts the certificate verification function from the back-end two-factor authentication service and places it at the Ingress object at the network entry point. This extraction allows invalid requests to be identified and rejected early in the request flow, preventing them from consuming back-end resources while maintaining the ability to handle legitimate authentication requests efficiently.
Solution Approach 2:
The system performs preliminary certificate verification at the Ingress object before requests are queued or forwarded to the back-end service. By validating certificates in advance using the configured root certificate, the system prevents invalid requests from entering the request queue or reaching the back-end, thereby eliminating resource waste from processing malicious requests.
3Reliability
If certificate verification is performed only at the back end, then authentication can be completed, but the back-end service is vulnerable to crashes from sudden increases in authentication requests during attacks
Solution Approach 1:
The patent segments the authentication process into two distinct stages: front-end certificate verification at the Ingress object and back-end authentication validation. This segmentation allows the system to perform lightweight certificate validation at the network entry point using the configured root certificate, filtering out malicious requests before they reach the back-end service, while maintaining complete authentication functionality at both levels.
Solution Approach 2:
The Ingress object configured with the root certificate serves as an intermediary that performs preliminary trust verification. This intermediary layer protects the back-end service by rejecting requests with invalid certificates before they can cause service crashes, while still allowing legitimate authentication requests to proceed to the back-end for complete verification.
Data Source
AI summary
A method and device for two-factor authentication, a computer device, and a storage medium are provided. The method includes: acquiring a root certificate and importing the root certificate into a two-factor service, and configuring an Ingress object according to the root certificate; generating a user certificate by using the two-factor service, and issuing the user certificate to a user according to the root certificate; intercepting an access request from a client by using the Ingress object, and performing, according to the root certificate, trustworthiness verification on a user certificate to be authenticated carried in the access request; and in a case where the user certificate to be authenticated carried in the access request is trustworthy, forwarding the access request to the two-factor service for further authentication.