Proxy Session Establishment Using Encrypted Password Handoff
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of plaintext passwords for logging into user accounts leads to security vulnerabilities, as malicious actors can gain unauthorized access by obtaining these passwords, and manual management of access policies introduces latency and potential human errors.
Innovation Solution
An identity management system provides an encrypted password to a software client or a gateway, using a secrets service to encrypt the password and manage sessions based on user labels, thereby reducing the risk of password exposure and enabling secure, automated access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If plaintext passwords are used for logging into user accounts, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent introduces a secrets service as an intermediary component that manages password encryption and decryption operations. This mediator handles the sensitive password data securely, allowing plaintext passwords to be stored and managed without exposing them to potential security breaches. The secrets service acts as a secure vault that can provide plaintext passwords only to authorized applications through controlled interfaces, thus maintaining both ease of operation and security.
2Adaptability or versatility
If manual management of access policies is implemented, then adaptability is improved, but productivity is worsened
Solution Approach 1:
The patent implements self-service capabilities where applications can autonomously request and receive plaintext passwords from the secrets service through automated API calls. This eliminates the need for manual administrative intervention in password distribution, allowing systems to dynamically adapt to changing access requirements while maintaining high productivity. The automated workflow enables rapid provisioning of credentials without human latency.
3Reliability
If encrypted passwords are provided to end-clients, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent extracts the cryptographic operations (encryption and decryption) from the end-client devices and centralizes them in the secrets service. This extraction eliminates the need for complex cryptographic implementations in client devices, maintaining security by keeping password management centralized while reducing device complexity. The secrets service handles all encryption/decryption operations, and clients simply interact through simple API calls.
Data Source
AI summary
A method for managing sessions with an application server via an identity management system is described. The method may include receiving, via an application protocol interface (API) of a cloud service of the identity management system, a first request associated with a first user for user access to an account of the application server. The API may transmit a second request for a secrets service to encrypt a password associated with the first user to a public key of a keypair. The API may receive a message including the encrypted password and forward the encrypted password to an end-client. The identity management system may establish a session on behalf of the first user for the account of the application server based on the end-client having access to a private key of the keypair.