Pool-Based Identity Authentication Without Stored Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional identification and authentication mechanisms for computer-implemented services or software processes are inadequate as they rely on stored credentials, which are risky and inefficient, especially in large-scale enterprises where thousands of services need to communicate securely without using password authentication.
Innovation Solution
A computer-implemented system for pool-based identity authentication that uses real-time deployment configuration information stored in a provisioning repository, combined with independently verifiable data, to authenticate service requests without relying on stored credentials, employing protocols like SAML for secure communication and leveraging a trusted authentication authority to validate service consumer identities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based authentication is used for service identification, then authentication can be implemented, but security is compromised because passwords can be easily stolen and used for unauthorized purposes
Solution Approach 1:
The patent extracts the authentication mechanism from traditional password-based systems and replaces it with certificate-based authentication. Services are assigned digital certificates that serve as their identity, eliminating the need to store or transmit passwords. This extraction of the harmful password element while retaining the authentication function directly resolves the security vulnerability described in the contradiction.
Solution Approach 2:
The patent introduces a certificate authority as an intermediary that issues and manages digital certificates for services. Instead of services directly sharing passwords with each other, authentication is mediated through certificates verified by a trusted authority. This intermediary mechanism eliminates direct credential exposure while maintaining authentication reliability.
2Ease of operation
If stored credentials are used for service authentication, then authentication can be performed, but the system becomes vulnerable to unauthorized access and credential compromise
Solution Approach 1:
The patent replaces the mechanical password storage and transmission system with a cryptographic certificate-based system. Instead of storing plaintext or hashed passwords in databases, the system uses public key infrastructure where services hold private keys and present public certificates for authentication. This substitution eliminates the vulnerability of stored credentials while maintaining ease of authentication operations.
3Productivity
If traditional authentication mechanisms are used in large-scale enterprises with thousands of services, then service communication can be controlled, but deployment and reconfiguration become bottlenecked
Solution Approach 1:
The patent implements preliminary action by pre-issuing digital certificates to services during the service deployment process itself, rather than requiring separate authentication configuration steps. When a new service is deployed, it automatically receives its certificate, enabling immediate authentication without additional manual configuration. This preliminary provisioning of authentication credentials eliminates deployment bottlenecks in large-scale enterprise environments.
Data Source
AI summary
A computer-implemented system and method for pool-based identity authentication for service access without use of stored credentials is disclosed. The method in an example embodiment includes providing provisioning information for storage in a provisioning repository; receiving a service request from a service consumer, the service request including requestor identifying information; generating an authentication request to send to an authentication authority, the authentication request including requestor identifying information; receiving validation of an authenticated service request from the authentication authority; and providing the requested service to the service consumer.