Pool-Based Identity Generation for Service Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Services Oriented Architecture (SOA), there is a need for secure and non-portable credentials to authenticate and authorize computer-implemented services, as conventional password-based mechanisms are inadequate for identifying and authenticating software processes or applications.
Innovation Solution
A computer-implemented system and method for pool-based identity generation using an identity generator to create signed identity documents, which are securely deployed on target machines, leveraging independently verifiable data such as IP addresses and SAML for authentication and authorization, ensuring that credentials are trusted and non-portable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based authentication mechanisms are used for service identification, then authentication can be implemented, but security is compromised because passwords can be easily stolen and used for unauthorized purposes
Solution Approach 1:
The credential system is segmented into multiple components: service principal names (SPNs) that identify services, tokens that carry authentication information, and credential stores that securely hold credentials. This segmentation allows different parts of the authentication system to have different security properties, with tokens being portable but bound to specific service contexts through SPNs.
Solution Approach 2:
The patent introduces an intermediary authentication system that uses service principal names and tokens as mediators between services. Instead of services directly sharing passwords, an intermediary authentication mechanism issues bounded tokens that prove service identity without exposing secret credentials. This intermediary layer enables secure service-to-service authentication while preventing credential theft.
2Productivity
If services are allowed to communicate with each other in large-scale enterprises, then communication efficiency is improved, but security checks and access controls become more complex
Solution Approach 1:
The patent implements a universal authentication system using service principal names and tokens that can be applied across all service communications in the enterprise. This universal mechanism handles multiple functions: authentication, authorization, and credential management, thereby reducing the need for separate access control mechanisms for different service pairs and simplifying overall system complexity.
Solution Approach 2:
The system changes the authentication parameters from static passwords to dynamic tokens with bounded validity periods and specific usage contexts. Tokens include temporal parameters (validity windows), spatial parameters (allowed service principals), and functional parameters (authorized operations). This parameter-based approach enables fine-grained access control without requiring complex configuration for each service pair.
Data Source
AI summary
A computer-implemented system and method for pool-based identity generation and use for service access is disclosed. The method in an example embodiment includes seeding an identity generator with a private key; retrieving independently verifiable data corresponding to a service consumer; using the independently verifiable data to create signed assertions corresponding to the service consumer; generating a non-portable identity document associated with the service consumer, the identity document including the signed assertions; signing the identity document with the private key; and conveying the signed identity document to the service consumer via a secure link.