Intermediary Authentication Service for Cross-System Credential Linking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computing systems face challenges in authorizing access to distributed resources, where users from one system need to access data or functionality from another system, often requiring duplicate authentication management or sharing credentials, which is administratively burdensome and can lead to security issues.
Innovation Solution
A computer-implemented method using a software component to store and link user credentials from one system to access another system, allowing authentication and establishing a secure connection for authorized access, with the option to provide limited access and manage credentials efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users of system 110 are given authentication accounts in system 120, then users can access system 120 resources, but administrative burden increases due to managing double the number of authentication issues
Solution Approach 1:
The patent introduces an intermediary authentication service that mediates between system 110 and system 120. This service receives authentication requests from system 110 users, validates them against system 120's authentication requirements, and establishes connections without requiring system 110 administrators to directly manage system 120 accounts. The intermediary handles the complexity of cross-system authentication protocols and credential management.
Solution Approach 2:
The authentication service is designed to handle multiple authentication scenarios universally - it can authenticate users from system 110 to access system 120, manage shared credentials, and handle various authentication protocols. This multi-functional approach consolidates what would otherwise require separate authentication management systems for each scenario.
2Ease of operation
If users of system 110 share one authentication credential, then access to system 120 is simplified, but security risks increase and service terms may be violated
Solution Approach 1:
The patent segments the shared authentication credential into individual user-specific credentials. Instead of one shared credential for all users, the system creates and manages separate credentials for each user that are linked to the system 110 authentication. This segmentation maintains security by ensuring each user has their own authenticated identity while simplifying access through automatic credential provisioning.
Solution Approach 2:
The authentication service acts as an intermediary that manages credential distribution and validation. It receives authentication requests from system 110 users, provisions appropriate credentials for system 120 access, and validates them securely. This intermediary layer ensures that credential sharing doesn't compromise security by maintaining proper authentication trails and user-specific credential management.
3Reliability
If system 120 locks out authentication credentials due to errors, then security is maintained, but all users sharing the credential lose access
Solution Approach 1:
By segmenting the shared credential into individual user credentials, the patent ensures that authentication errors affect only the specific user who made the error, not all users. Each user has their own credential instance that can be independently validated and locked out, preventing cascade failures across the entire user group.
Solution Approach 2:
The authentication service implements feedback mechanisms that monitor authentication attempts and provide real-time information about credential status. When authentication errors occur, the system can provide feedback to the affected user about the lockout status and allow for recovery procedures without affecting other users' access to system 120.
Data Source
AI summary
Embodiments of the present disclosure pertain to accessing computing resources. In one embodiment, the present disclosure includes a computer implemented method comprising storing at least one credential for accessing a first system, storing a plurality of user credentials for a plurality of users having access to a second system, linking the plurality of user credentials for the plurality of users having access to the second system to the at least one credential for accessing the first system, receiving a first user credential for a first user from the second system over a first connection, authenticating the first user credential, wherein the first user credential is authenticated when the first user credential matches one of the stored plurality of user credentials, and establishing a second connection between the first system and the second system using the at least one credential when the first user credential is authenticated.