Session-Based Password Caching for Distributed System Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges with managing multiple passwords for distributed computer systems, leading to security issues and high helpdesk costs due to password expiration, complexity, and the risk of unauthorized access when using existing Single Sign-On (SSO) products, which either synchronize passwords insecurely or store them in databases with two-way encryption.
Innovation Solution
A method that caches passwords in a non-persistent, encrypted manner within a session, allowing reuse across systems accessible with the same password while requiring re-entry for different passwords, and divides systems into security zones to enforce distinct access controls, preventing mass password exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password synchronization is used to access multiple systems with a single password, then user convenience is improved, but security is worsened because if the password gets into the wrong hands, all systems can be directly accessed
Solution Approach 1:
The patent segments the authentication process by dividing systems into different security zones (first security zone with first password, second security zone with second password). This segmentation prevents a single compromised password from providing access to all systems, thereby resolving the security issue while maintaining ease of operation within each zone.
Solution Approach 2:
The patent applies local quality by assigning different password requirements to different security zones based on their specific security needs. High-security systems require different passwords while lower-security systems can share passwords, optimizing both security and convenience for each local context.
2Ease of operation
If database-based passwords with master password are used, then access to multiple systems is simplified, but security is worsened due to two-way encryption vulnerabilities and the risk that master password access enables unauthorized access to all systems
Solution Approach 1:
The patent eliminates the master password concept by segmenting authentication into zone-specific passwords. Each security zone has its own password requirements, removing the single point of failure (master password) that could compromise the entire system.
Solution Approach 2:
The patent extracts and removes the vulnerable master password mechanism from the system. Instead of storing passwords in a database with two-way encryption, the system directly verifies passwords against security zone requirements, eliminating the security vulnerabilities associated with master password storage and retrieval.
3Extent of automation
If commercial SSO products are deployed for complete IT infrastructure, then centralized authentication is achieved, but cost increases and new problems are introduced
Solution Approach 1:
The patent implements self-service authentication where the system automatically determines which security zone a user should access based on their credentials, without requiring complex commercial SSO product infrastructure. The authentication process is self-contained within the operating system's security manager.
Solution Approach 2:
The patent creates a universal authentication mechanism that works across different security zones and systems within the distributed computer system. The security manager provides multi-functional authentication capabilities without requiring separate commercial SSO products for each system.
4Ease of operation
If users write down passwords to remember them, then ease of operation is improved, but security is worsened as it violates basic security rules
Solution Approach 1:
The patent segments password requirements so that users only need to remember one password per security zone rather than multiple passwords for each system. This reduces the burden of password management while maintaining security through zone-based access control.
Data Source
AI summary
mechanisms are provided to securely access systems of a distributed computer system by entering passwords. Some systems are accessible by equal, and some systems are accessible by different passwords. The mechanisms store information, which systems (I, II) are accessible by equal, and which are accessible by different passwords and ask to enter a proper password when opening a session by accessing a system of the distributed computer system. The mechanisms cache the password and use the stored information to verify, if another system to be accessed during the current session is accessible by an equal password like a system already accessed during said session. If the result of the verification is true, the mechanisms re-use the adequate cached password. If the result of the verification is false, the mechanism ask to enter a proper password to access the other system and cache the password required to access the other system in a way that during the current session, it can be re-used when accessing other systems accessible by the same password.