Authentication Proxy Server for Kerberos One-Time Password Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Kerberos authentication systems fail to work with one-time passwords (OTPs) as they rely on static passwords mapped to usernames in a database, preventing users from utilizing OTPs for single sign-on (SSO) authentication.
Innovation Solution
An Authentication Proxy Server is introduced to authenticate OTPs and update the Kerberos database, allowing the latest OTP to be used as a 'permanent' password for SSO authentication, enabling users to access multiple application servers without re-entering their password.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Kerberos authentication system uses static passwords mapped to usernames in database, then SSO authentication can be implemented, but security is compromised because static passwords are vulnerable to intrusion
Solution Approach 1:
The patent introduces an authentication proxy server as an intermediary between the client and the Kerberos authentication server. This proxy server captures authentication requests, replaces OTPs with temporary passwords, and forwards them to the Kerberos system. This mediator enables OTP-based authentication while maintaining compatibility with the existing Kerberos SSO infrastructure, resolving the contradiction between security improvement and system compatibility.
2Reliability
If OTP is used for authentication, then security is improved, but the Kerberos database structure must be changed to support dynamic passwords
Solution Approach 1:
The patent segments the authentication system into distinct functional components: the authentication proxy server handles OTP validation and temporary password generation, while the Kerberos database maintains its原有 structure for username-password mapping. This segmentation allows OTP-based authentication without requiring changes to the Kerberos database structure, thus improving security while avoiding increased system complexity.
Solution Approach 2:
The authentication proxy server creates a temporary password copy of the OTP for use with the Kerberos system. Instead of modifying the original OTP or the database structure, the proxy server generates a temporary password that mimics the OTP's authentication function, allowing the existing database structure to remain unchanged while enabling secure OTP-based authentication.
3Reliability
If user enters password for each application access, then security is maintained, but user convenience and system efficiency deteriorate
Solution Approach 1:
The patent implements preliminary authentication where the user enters their OTP once at the authentication proxy server. The proxy server then establishes a session and generates temporary passwords for subsequent application accesses. This preliminary action eliminates the need for repeated password entry, significantly improving user convenience while maintaining security through the use of OTPs and session-based authentication.
Data Source
AI summary
A method, computer program product, authentication proxy server, and system for enabling a user to use a one-time password in conjunction with single sign-on authentication and external authentication, such as provided by the Kerberos protocol, are provided.