Privacy-aware ID Gateway Federation Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the number of web applications increases, authentication servers face significant computational resource challenges in managing user IDs and passwords, and existing Single Sign-On (SSO) systems require extensive resources to facilitate seamless access across multiple applications.
Innovation Solution
A method where a federation server, acting as both an Identity Provider (IDP) and Service Provider (SP), manages ID federations between applications, allowing a first user authenticated on one application to access information on another application by converting their ID using a second ID federation, thereby reducing the computational load on the authentication server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If an authentication server manages IDs and passwords of all users across multiple web applications, then single-sign-on functionality is achieved, but computational resources increase drastically
Solution Approach 1:
The patent segments the authentication system into multiple independent authentication servers, each responsible for a specific application or subset of applications. Instead of one server managing all user credentials across all applications, each application has its own authentication server that manages only its users' IDs and passwords. This segmentation reduces the computational burden on each server while maintaining SSO functionality through federation protocols.
Solution Approach 2:
The patent introduces authentication information (such as tokens or federated credentials) as an intermediary mechanism between authentication servers. When a user authenticated on one application needs to access another application, the authentication information serves as a mediator that proves the user's identity without requiring the second application's authentication server to store or process the user's original credentials. This reduces the computational load on individual servers.
2Adaptability or versatility
If a user provides another user with their own information by letting the other user sign-on as the one user, then information sharing is enabled, but computational resources increase
Solution Approach 1:
The patent implements a copying mechanism where authentication information is replicated or federated across different authentication servers. When user A allows user B to access their information, the authentication information representing user A's identity is copied or federated to enable user B's access. This copying approach allows information sharing without requiring the original authentication server to continuously verify or manage the shared access, reducing computational overhead.
Data Source
AI summary
A method includes, for a first user having been authenticated on a first application with a first user identification (ID) using a first ID federation between the first application and a federation server, determining that the first user is authorized to access information of a second user on a second application based on the first user ID, the second user being associated with a second user ID, and sending a second authentication request for authenticating the first user to the second application with the second user ID using a second ID federation between the federation server and the second application.