On-Premises Agent Authentication for Enterprise Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise identity authentication systems face challenges in securely authenticating off-premises devices due to increased security risks, as they may be more vulnerable to attacks, and existing solutions struggle to differentiate between on-premises and off-premises access while maintaining security policies.
Innovation Solution
Implementing an on-premises verification process using an on-premises agent (OPA) and identity server (IS) that transmits verification commands and responses, including client-side scripts, to validate device location and enforce security policies, potentially using HTTPS or HTTP protocols depending on certificate availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If off-premises devices are allowed to access enterprise services, then service accessibility is improved, but security risks increase
Solution Approach 1:
The authentication system is segmented into multiple independent components: identity server, on-premises agent, and client device. The verification process is divided into distinct phases (initial authentication, on-premises verification, service access) allowing selective application of security measures based on device location
Solution Approach 2:
The on-premises agent acts as an intermediary component that bridges the identity server and client devices. It performs local verification of device location and network connectivity, mediating between the security requirements of the enterprise network and the access requests from external devices
2Reliability
If additional authentication layers are implemented for off-premises devices, then security is improved, but authentication complexity increases
Solution Approach 1:
The system performs preliminary actions by pre-configuring the on-premises agent on authorized devices and pre-establishing trust relationships between the identity server and agent. This allows rapid verification during authentication without requiring complex real-time decisions
Solution Approach 2:
The authentication process is made dynamic by adapting the verification steps based on device location. On-premises devices undergo simplified verification, while off-premises devices trigger additional verification steps, allowing the system to optimize security based on real-time conditions
3Reliability
If on-premises verification is required, then security policy enforcement is improved, but access convenience deteriorates
Solution Approach 1:
Different verification procedures are applied based on device location quality. Devices verified as on-premises receive simplified access, while off-premises devices undergo more rigorous verification. The on-premises agent optimizes local verification by checking network connectivity and device identity without requiring full remote authentication protocols
Data Source
AI summary
Systems, methods, and software can be used to provide authentication for an enterprise service. In some aspects, an identity server receives an authentication request. An on-premises verification command is transmitted. The on-premises verification command indicates an on-premises agent that verifies on-premises network connectivity. In response to the on-premises verification command, an on-premises verification response message is received. An authentication response is transmitted based on the received on-premises verification response message.