SAML AJAX Request Detection for IDP Server Load Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Single Sign-On (SSO) systems that utilize Security Assertion Markup Language (SAML) and cloud access security brokers (CASBs), AJAX requests cause a flood of authentication requests on Identity Provider (IDP) servers, leading to severe server load due to incomplete SAML transactions and repeated probes from consumer sites, which are not recognized by the browser's JavaScript engine.
Innovation Solution
Implementing a system that differentiates between AJAX and non-AJAX requests by serving an AJAX detector page, which runs JavaScript to confirm the request type, thereby redirecting only valid requests to the IDP server and reducing unnecessary load on IDP servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If AJAX requests are allowed in SSO systems, then user interface responsiveness is improved, but server load increases due to flood of authentication requests
Solution Approach 1:
The patent introduces an intermediary detection mechanism that sits between the AJAX requests and the IDP server. This intermediary analyzes incoming requests to determine if they are AJAX requests, and if so, prevents them from being forwarded to the IDP server. This mediator approach allows the system to maintain AJAX functionality for legitimate uses while blocking the flood of authentication probe requests that would otherwise overload the server.
Solution Approach 2:
The system performs preliminary detection and classification of requests before they reach the authentication processing stage. By examining request characteristics upfront and identifying AJAX requests early in the request lifecycle, the system can take preventive action to stop potentially harmful requests from consuming server resources, rather than dealing with the overload after it occurs.
2Reliability
If all requests are redirected to IDP server for authentication, then security is maintained, but incomplete SAML transactions consume server resources
Solution Approach 1:
The detection mechanism acts as an intermediary filter between external requests and the IDP server's authentication processing. It examines request characteristics to identify AJAX requests that are likely to result in incomplete SAML transactions, and blocks these requests before they consume server resources. This maintains security for legitimate requests while preventing waste from incomplete transactions.
Solution Approach 2:
The patent extracts and removes the harmful component (AJAX requests that lead to incomplete SAML transactions) from the request stream before processing. By identifying and extracting these problematic requests based on their characteristic patterns, the system prevents them from entering the authentication flow and consuming server resources, while allowing legitimate requests to proceed normally.
3Ease of operation
If consumer sites repeatedly probe for user authentication status, then user experience is enhanced, but IDP server experiences severe load
Solution Approach 1:
The detection mechanism serves as an intermediary that allows legitimate authentication status checks to proceed while blocking repeated probe requests from consumer sites. It analyzes request patterns to distinguish between genuine user-initiated authentication needs and automated probing, permitting the former while preventing the latter from overloading the IDP server.
Solution Approach 2:
The system takes a selective approach by allowing some authentication requests through (partial action) while blocking others (excessive action). Rather than completely preventing all authentication status checks, it permits legitimate user-initiated requests while blocking the excessive repeated probes from consumer sites that would otherwise overwhelm the server, achieving a balance between user experience and server capacity.
Data Source
AI summary
A computer-implemented method for server load control may include: (a) receiving a request of a first type or a second type; (b) transmitting a response of a form that will not be processed by the second computer, thereby reducing the load on a third computer, when the request is of the first type, and that will be processed by the second computer when the request is of the second type; and (c) when the request is of the second type and the response is processed by the second computer, receiving a message from the second computer that results from the processed response and indicates that the request is not of the first type. Various other methods, systems, and computer-readable media are also disclosed.