Network Context-Based User Authentication via Cloud Identity Provider
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in authenticating users accessing cloud-based computing solutions when they are outside the corporate network due to firewall restrictions, requiring different authentication mechanisms and entry points based on network location.
Innovation Solution
A system that uses a cloud identity provider with a user location determination module to delegate authentication to either a cloud identity provider or a corporate identity management system based on the user's network context, employing Pluggable Authentication Modules (PAMs) and SAML for secure authentication, allowing consistent access via a single entry point regardless of location.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a corporate firewall is employed to protect the corporate network from malevolent external access, then network security is improved, but cloud-based solutions become inaccessible to employees outside the corporate network
Solution Approach 1:
The patent introduces a cloud-based identity provider as an intermediary authentication service. When employees outside the corporate network need to access cloud-based solutions, the system redirects them to the cloud identity provider which handles authentication without requiring connection to the protected corporate network. This mediator enables external access while the corporate firewall remains intact, resolving the contradiction between security and accessibility.
2Reliability
If different authentication mechanisms are used for internal and external users, then authentication reliability is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal authentication system where a single cloud-based identity provider serves multiple authentication functions. The same cloud identity provider handles both internal corporate network authentication and external authentication, replacing the need for separate authentication mechanisms. This multi-functional approach maintains authentication reliability while reducing system complexity by consolidating authentication capabilities into a single universal service.
Data Source
AI summary
Example systems and methods of user authentication based on network context are presented. In one example, a command to authenticate a user of a computing device is received in response to a request transmitted from the computing device to access a computing solution. In response to the command, a determination is made whether a network address corresponding to the request matches at least one network address associated with a protected network. Based on the network address corresponding to the request not matching the at least one network address associated with the protected network, authentication of the user is initiated at an identity provider corresponding to the computing solution. Otherwise, based on the network address corresponding to the request matching the at least one network address associated with the protected network, authentication of the user is delegated to an identity management system located within the protected network.