Nonce Handler for Reverse Proxy SSO Authentication

Solution Overview

Problem

Conventional systems using reverse proxy services for authentication are incompatible with unique session identifiers, leading to rejection of login attempts due to domain differences, which compromises security and efficiency.

Innovation Solution

Implement a method where a client initiates a first login request with a service provider, generating and hashing a unique session identifier, and if the reverse proxy service does not recognize it, a second login request is initiated to obtain a new session identifier, allowing the reverse proxy service to authenticate and complete the login session.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a reverse proxy service is used for authentication, then access to services behind the proxy is enabled, but the unique session identifier cannot be recognized due to domain differences causing login rejection

Engineering Contradiction:

Improveauthentication capabilityVSAvoidsession identifier recognition

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent introduces a nonce handler as an intermediary component that mediates between the reverse proxy service and the service provider. This handler stores the unique session identifier (nonce) and facilitates communication across the domain boundary, allowing the proxy to recognize and transmit the session identifier to the service provider without direct domain conflicts.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary action by pre-storing the unique session identifier in the reverse proxy service before authentication occurs. This advance preparation ensures that when the authentication request is made, the session identifier is already available in the proxy, eliminating the need for real-time retrieval and preventing domain-related recognition failures.

Inventive Principle:

Principle #10Preliminary action

2Object-affected harmful factors

If a unique session identifier is used to prevent replay attacks, then security is improved, but the reverse proxy service cannot access the identifier due to domain differences

Engineering Contradiction:

Improvereplay attack preventionVSAvoidproxy service compatibility

Core Design Contradiction:

Object-affected harmful factorsVSAdaptability or versatility

Solution Approach 1:

The nonce handler serves as a mediator that bridges the gap between the reverse proxy and service provider. It receives the unique session identifier from the service provider, stores it locally, and makes it available for authentication requests, thereby maintaining security while enabling proxy compatibility.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary action by pre-storing the unique session identifier in the reverse proxy service before authentication occurs. This advance preparation ensures that when the authentication request is made, the session identifier is already available in the proxy, eliminating the need for real-time retrieval and preventing domain-related recognition failures.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If the reverse proxy service uses a different domain, then network architecture flexibility is improved, but authentication fails due to inability to provide the nonce value

Engineering Contradiction:

Improvenetwork architecture flexibilityVSAvoidauthentication success rate

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The nonce handler acts as an intermediary component that resolves the domain boundary problem. It stores the unique session identifier and facilitates the transmission of authentication information between the proxy and service provider, enabling successful authentication despite the different domain configuration.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary action by pre-storing the unique session identifier in the reverse proxy service before authentication occurs. This advance preparation ensures that when the authentication request is made, the session identifier is already available in the proxy, eliminating the need for real-time retrieval and preventing domain-related recognition failures.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentEP3854049B1Nonce handler for single sign on authentication in reverse proxy solutions

Publication Date: 2022.04.20 MICROSOFT TECHNOLOGY LICENSING LLC

Figure 1
Figure 2A
Figure 2B

AI summary

Methods, systems, and media are shown for providing a reverse proxy system with SSO capability involving receiving an authentication response message from a client that includes an authentication token and a unique session identifier and determining whether the identifier is stored on the proxy service. If the session identifier is stored on the proxy service, sending the authentication response message to a service provider to which the authentication response message is directed. If the session identifier in the authentication response message is not stored on the proxy service: sending a login request message to the service provider to which the authentication response message is directed, receiving an authentication request message from the service provider that includes an other unique session identifier and redirects the authentication request message to an identity provider, storing the other session identifier, and sending the authentication request message with the other identifier to the client.