Runtime Authentication Journey Configuration for Multi-Customer Scaling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static authentication trees are computationally complex, limited in use-case scope, and introduce security risks due to out-of-date nodes, making them difficult to manage and scale with growing numbers of customers, especially when dealing with multiple Identity Providers (IDPs) and varying access details.
Innovation Solution
Implementing a runtime configuration system that dynamically configures authentication nodes and connections in response to user input, using a factory method to apply configuration parameters to an editable script, allowing flexible customization and delegation of configuration to customer administrators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If static authentication trees are used to manage authentication journeys, then security management is simpler for small platforms, but the system becomes difficult to maintain and scale as the number of customers grows
Solution Approach 1:
The patent segments the authentication tree into reusable templates and customer-specific customizations. Templates define standard authentication flows that can be independently maintained, while customer-specific nodes can be added without affecting the core structure. This allows the security team to manage templates centrally while customers customize their own authentication journeys.
Solution Approach 2:
The patent introduces dynamic configuration capabilities that allow authentication trees to adapt at runtime. Instead of static, pre-configured authentication journeys, the system dynamically assembles authentication flows by combining template nodes with customer-specific configurations. This enables the system to scale to multiple customers while maintaining flexibility for individual customization.
2Reliability
If security updates are propagated through statically configured authentication journeys, then security can be maintained, but identifying and managing effects across custom journeys becomes difficult and time-consuming
Solution Approach 1:
By segmenting authentication journeys into templates and customizations, the patent enables targeted security updates. When a security issue is identified in a template node, the update can be propagated to all customers using that template without requiring individual testing of each custom journey. The segmentation isolates the scope of updates and simplifies impact analysis.
Solution Approach 2:
The patent implements feedback mechanisms that track which customers and journeys use specific template nodes. This feedback information enables the security team to automatically identify affected journeys when updates are needed, reducing the time to propagate security updates while ensuring comprehensive coverage.
3Adaptability or versatility
If multiple administrators are delegated to configure custom nodes, then customer-specific customization is enabled, but ensuring consistent configuration with platform security architecture becomes challenging
Solution Approach 1:
The patent creates universal templates that embody platform security architecture requirements. These templates serve multiple functions: they define standard security controls, ensure consistency across customers, and provide a reusable framework for customization. Administrators configure customer-specific nodes within the constraints of these universal templates, ensuring alignment with platform security standards.
Solution Approach 2:
The patent introduces templates as intermediary artifacts between platform security requirements and customer-specific configurations. Templates act as mediators that translate security architecture requirements into configurable parameters, guiding administrators to create consistent customizations without directly encoding platform security constraints into each customer journey.
4Ease of manufacture
If statically configured authentication nodes are used, then authentication journeys can be defined in advance, but the system lacks flexibility to adapt to varying access details and legacy systems
Solution Approach 1:
The patent transitions from static to dynamic authentication journey configuration. Instead of defining complete authentication flows in advance, the system uses templates that define patterns and rules for constructing journeys. At runtime, the system dynamically assembles authentication flows by selecting and configuring template nodes based on customer-specific requirements, enabling adaptation to varying access details and legacy systems.
Solution Approach 2:
The patent enables parameter-driven customization of authentication journeys. Templates define authentication flows with configurable parameters that can be adjusted for different customers and scenarios. This allows the same template to generate multiple variations of authentication journeys by changing parameters such as authentication methods, required factors, and routing logic, providing flexibility without requiring separate static configurations for each scenario.
Data Source
AI summary
The disclosed technology teaches a method for customers of an organization to perform configuration at runtime for authentication journeys used by the customer's users, to simplify authentication trees, and to delegate configuration to the customer's administrators, wherein an authentication tree implements an authentication journey, the authentication tree including authentication nodes and edges connecting the authentication nodes. The method includes configuring an editable script and an authentication node used in the authentication tree in response to a user invocation of the authentication journey by executing a factory method that applies configuration parameters to the editable script and to parameters used to access an API.