On-Premises Authentication Intermediary for Cloud SaaS Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for managing authentication information in SaaS environments lack secure solutions for transmitting and verifying user credentials without exposing plain-text passwords to external entities, posing security and regulatory risks.
Innovation Solution
Implementing asymmetric cryptography to encrypt authentication information on a client device using a public key, with decryption and validation performed by an on-premises component behind a firewall, ensuring that only the enterprise controls the decryption key and preventing exposure of plain-text passwords to external systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If authentication information is transmitted to cloud-based service for verification, then user access to SaaS application is enabled, but authentication information may be exposed to external entities
Solution Approach 1:
An on-premises authentication service acts as an intermediary between the cloud-based SaaS application and the enterprise's authentication infrastructure. This intermediary receives authentication requests from the cloud service, validates credentials locally using enterprise-controlled authentication mechanisms, and returns verification results without exposing plaintext credentials to external entities.
Solution Approach 2:
The authentication system is segmented into separate components: the cloud-based SaaS application handles user interface and business logic, while the on-premises authentication service handles credential verification. This segmentation allows each component to perform its specific function while maintaining security boundaries, with the on-premises component protecting sensitive authentication operations.
2Adaptability or versatility
If enterprise shares authentication information with cloud-based service, then SaaS application functionality is enabled, but security control and regulatory compliance are compromised
Solution Approach 1:
The on-premises authentication service serves as a trusted intermediary that enables SaaS application functionality while maintaining enterprise security control. It receives encrypted authentication data from the cloud service, decrypts and validates it using enterprise-controlled credentials, and returns verification results without the cloud service ever accessing plaintext authentication information.
Solution Approach 2:
The enterprise configures and secures the on-premises authentication service before deploying the SaaS application. Authentication credentials and verification mechanisms are established in advance on the enterprise's controlled infrastructure, ensuring security controls are in place before any authentication operations begin.
3Measurement precision
If plaintext passwords are transmitted over network, then authentication verification is performed, but network security and data protection are compromised
Solution Approach 1:
The on-premises authentication service acts as a secure intermediary that receives encrypted authentication information from the cloud-based service, decrypts it using enterprise-controlled keys, and performs verification locally. This eliminates the need for plaintext password transmission across the network, as decryption and verification occur within the enterprise's secure perimeter.
Solution Approach 2:
The authentication verification process is localized to the enterprise's on-premises infrastructure where security controls are enforced. Encrypted authentication data is decrypted and validated within the enterprise's controlled environment rather than being transmitted in plaintext across untrusted networks, ensuring that sensitive operations occur only in secure locations.
Data Source
AI summary
This disclosure is directed to systems and methods for securely communicating authentication information in a networked environment such as one involving a client device, a cloud based computing platform, and an enterprise computing environment. Some embodiments may include encrypting, by a client device using a public key, authentication information provided by a user. The encrypted authentication information is sent to a cloud based service which then sends it to an on-premises component residing behind a firewall of an enterprise. The on-premises component decrypts the authentication information using a private key, validates the authentication information, and returns the result to the cloud based service over a network. If validated, the cloud based service establishes a secure connection between the client device and the on-premises component such that the user can access the enterprise's content without the enterprise having to share the authentication information with the cloud based service.