Remote Authenticator Mediates Non-Local Access to Domain Resources

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In distributed computing environments, non-local requestors face challenges in accessing resources across different domains due to restrictive access controls, requiring complex authentication mechanisms and pre-configured credentials, which hinders communication and functionality between distributed resources.

Innovation Solution

Implementing a system that uses a local authenticator within a domain to provide single-use credentials to non-local requestors, allowing them to access resources securely through a remote authenticator, decoupling access management from local account provisioning and leveraging established protocols like SSH for authentication.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If pre-configured credentials and complex authentication mechanisms are used for non-local requestors, then access control security is improved, but system complexity and difficulty of operation worsen

Engineering Contradiction:

Improveaccess control securityVSAvoidauthentication mechanism complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a remote authenticator as an intermediary component that mediates between non-local requestors and local resources. The remote authenticator receives authentication requests from non-local requestors, obtains credentials from the local authenticator on their behalf, and manages the credential lifecycle. This intermediary approach maintains security by ensuring credentials are issued through proper authentication while simplifying the process for non-local requestors who don't need direct access to the local authenticator or pre-configured credentials.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If pre-configured credentials are required for non-local requestors, then access control is improved, but ease of operation worsens

Engineering Contradiction:

Improveaccess controlVSAvoidauthentication process simplicity

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent implements a self-service mechanism where non-local requestors can autonomously obtain credentials through the remote authenticator without requiring manual pre-configuration or direct interaction with the local authenticator. The remote authenticator automatically manages the credential acquisition process by communicating with the local authenticator, handling credential validation, and ensuring proper access control. This self-service approach dramatically simplifies operation for non-local requestors while maintaining robust access control through the automated authentication workflow.

Inventive Principle:

Principle #25Self-service

3Ease of operation

If direct access to local authenticator is allowed for non-local requestors, then ease of access is improved, but security worsens

Engineering Contradiction:

Improveaccess to resourcesVSAvoidsecurity risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces the remote authenticator as a mandatory intermediary layer between non-local requestors and the local authenticator. Non-local requestors communicate exclusively with the remote authenticator, which then interacts with the local authenticator using its own credentials. This architecture ensures that non-local requestors never have direct access to the local authenticator, eliminating the security risk of exposing the local authenticator to external entities while still enabling convenient access to resources through the secured intermediary channel.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Adaptability or versatility

If distributed resources communicate across different domains, then functionality is improved, but authentication complexity worsens

Engineering Contradiction:

Improvecross-domain communication capabilityVSAvoidauthentication mechanism

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent creates a universal authentication framework where the remote authenticator serves multiple functions: it acts as an authentication endpoint for non-local requestors, a credential manager that interfaces with the local authenticator, and a security gateway that enforces access control policies. This multi-functional design allows distributed resources across different domains to communicate using a standardized authentication approach, eliminating the need for domain-specific authentication implementations and simplifying cross-domain communication while maintaining security.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11924189B2Systems and methods for credentialing of non local requestors in decoupled systems utilizing a domain local authenticator

Publication Date: 2024.03.05 OPEN TEXT SA ULC

AI summary

Embodiments as disclosed provide systems and methods that use a local authenticator within a domain to provide a credential to access a resource of the domain to a non-local requestor. When a request is received from a non-local requestor at the domain the non-local requestor can be authenticated based on the request. The local authenticator can then be accessed to obtain a credential. This credential may be the same type of credential provided to members of the domain when they authenticate using the local authenticator. The credential is provided to the non-local requestor so the non-local requestor can access the resource of the domain using the credential and authentication of the non-local requestor with respect to these accesses can be accomplished using the local domain authenticator and the credential.