SAML Firewall Access Using RBI-Mediated Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls struggle to accurately identify and allow SAML authentication requests when users attempt to access network resources, as they cannot distinguish between authentication packets and other WAN traffic, leading to restricted access.
Innovation Solution
A firewall system integrates a Remote Browser Isolation (RBI) server to intercept unauthenticated requests, redirecting users to a SAML Service Provider (SP) for authentication through a secure link, which communicates with a SAML Identity Provider (IDP) to verify credentials, ensuring only authorized users gain network access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the firewall blocks all unauthenticated traffic to protect the network, then network security is improved, but legitimate SAML authentication requests are rejected
Solution Approach 1:
The patent introduces a Remote Browser Isolation (RBI) server as an intermediary between the firewall and SAML authentication requests. The RBI server captures and processes authentication requests, isolating them from the firewall's main traffic flow. This allows the firewall to maintain its security blocking while the RBI server identifies and permits legitimate SAML authentication traffic through alternative processing paths.
2Extent of automation
If the firewall processes all authentication requests directly, then authentication control is improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent segments the authentication processing function from the firewall by introducing a dedicated RBI server. The firewall handles general traffic filtering while the RBI server specifically handles SAML authentication request processing. This segmentation reduces the firewall's processing overhead and complexity while maintaining automated authentication control through the specialized RBI server.
3Reliability
If the firewall restricts access to prevent unauthorized users, then security is improved, but authenticated users experience access delays
Solution Approach 1:
The RBI server performs preliminary processing of SAML authentication requests by identifying and isolating them before they reach the firewall's main processing queue. By pre-processing and tagging authentication requests, the system prepares them for rapid permission decisions, reducing the time delay experienced by authenticated users while maintaining security checks.
Data Source
AI summary
Disclosed are systems, apparatuses, methods, computer readable medium, and circuits for providing access to a network. According to at least one example, a method includes: intercepting a request at a firewall the request sent from a computing device regarding establishment of a secure communication session with a network; in response to determining that the request is unauthenticated, notifying a service provider node of the request, wherein the service provider node is configured to: generating a communication session between the computing device and a RBI server; receiving at the firewall authentication information pertaining to authorization for the computing device to establish the secure communication session with the network; identifying that the secure communication session is allowed to be established based on the authentication information; and providing access at the firewall to the computing device to establish the secure communication session with the network.