Multifactor Authentication Intermediary for Legacy Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Legacy network applications face challenges in implementing robust authentication due to outdated programming languages and lack of expertise, making it costly and error-prone to enhance security, especially with the need for multifactor authentication compliance with government regulations.
Innovation Solution
A method for providing multifactor authentication that involves a front-end service intercepting requests, redirecting users to an external authentication service for verification, and generating authentication credentials without modifying the legacy application, using techniques like SAML and Liberty to enhance security without altering existing systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code is updated on each front-line server and back-end systems to implement new authentication, then security is improved, but implementation cost and time increase significantly
Solution Approach 1:
The patent introduces an intermediary authentication service that sits between users and legacy applications. This service handles multifactor authentication externally, allowing legacy applications to maintain their original authentication code while still achieving enhanced security. The intermediary translates between modern authentication requirements and legacy application interfaces.
Solution Approach 2:
The authentication system is segmented into separate components: the legacy application remains unchanged, while a separate authentication service handles the enhanced security requirements. This segmentation allows each component to be developed and maintained independently, reducing implementation complexity and risk.
2Reliability
If legacy applications are rewritten to conform to new security regulations, then security compliance is improved, but development cost and time increase
Solution Approach 1:
The authentication service performs preliminary authentication actions before requests reach the legacy application. By pre-processing authentication requirements and translating them into legacy-compatible formats, the system achieves compliance without requiring time-consuming rewrites of legacy code.
Solution Approach 2:
The patent creates a virtual copy of the authentication interface that mimics legacy application expectations while implementing modern security. This copying approach allows the legacy application to interact with what appears to be its original interface, while actually engaging with enhanced authentication mechanisms.
3Reliability
If specialists are brought in to modify legacy application security, then security expertise is improved, but project cost and duration increase
Solution Approach 1:
The authentication service is designed to be self-configuring and automatically integrates with legacy applications through standard interfaces. This reduces the need for specialist intervention during implementation, as the system can be deployed with minimal manual configuration, thereby maintaining security expertise requirements while improving development efficiency.
4Reliability
If multifactor authentication is implemented in legacy systems, then security is improved, but system complexity increases
Solution Approach 1:
The authentication service acts as an intermediary that absorbs the complexity of multifactor authentication mechanisms. Legacy applications interact with simplified interfaces, while the intermediary handles the complex coordination of multiple authentication factors, cryptographic operations, and session management.
Solution Approach 2:
The authentication service provides universal support for multiple authentication methods (password, token, biometric, etc.) through a single unified interface. This multi-functionality allows legacy applications to benefit from enhanced security without needing to implement or understand the complexity of different authentication mechanisms.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In various embodiments of the invention, techniques are presented for providing multifactor authentication. A first set of credentials (365) are received, which are associated with a first principal (305), and at least one identifier also associated with the first principal is obtained from a second principal (340). Next, the first principal's knowledge of the at least one identifier is verified and an authentication credential (375) is generated for the first principal. The authentication credential permits the first principal to access the second principal.