Secure Directory Access via Proxy Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for hosted services to access an organization's internal directory service for authentication and authorization require duplicating directory records outside the internal network, compromising security and requiring complex synchronization, as well as exposing internal records to unauthorized access.
Innovation Solution
A secure direct connection is established between the internal directory service and a remote directory service on hosted services using a rendezvous service, eliminating the need for an external hosted directory service, with a directory service proxy server managing connections and ensuring security through certificate exchange and API controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an external hosted directory service is created to provide authentication and authorization for hosted services, then hosted services can access directory service functionality, but the directory records are exposed outside the organization's secure internal network where they might be accessed or altered by unauthorized individuals
Solution Approach 1:
The patent introduces a gateway component that acts as an intermediary between the hosted service and the internal directory service. The gateway receives authentication requests from the hosted service, forwards them to the internal directory service through the firewall, and returns the results. This mediator allows external services to access directory functionality without exposing the internal directory records to external threats.
2Adaptability or versatility
If a copy of the internal directory service is created in the hosted environment, then authentication and authorization can be provided, but complex synchronization mechanisms are required to keep the hosted and internal directory services consistent
Solution Approach 1:
Instead of creating and maintaining a complete copy of the directory service in the hosted environment, the patent extracts only the necessary authentication functionality. The hosted service contains minimal authentication logic that delegates all directory service operations to the internal directory service through the gateway. This extraction eliminates the need for complex synchronization mechanisms while maintaining authentication capability.
3Ease of operation
If the internal directory service is exposed to direct public access for hosted services, then hosted applications can authenticate users directly, but the internal network and directory service become vulnerable to unauthorized access and attacks
Solution Approach 1:
The gateway serves as a secure intermediary that sits between the public hosted services and the internal directory service. It accepts authentication requests from hosted applications, validates them against the internal directory service, and returns results without exposing the internal network. This mediator maintains ease of operation for authentication while protecting network security by keeping the internal directory service behind the firewall.
4Adaptability or versatility
If users are required to maintain separate account records for hosted services and internal network services, then hosted services can operate independently, but users must remember multiple account names and passwords increasing operational complexity
Solution Approach 1:
The patent merges the authentication functionality of hosted services with the organization's internal directory service through the gateway. Users authenticate against the same internal directory service for both hosted services and internal network services, eliminating the need for separate account records. This combining maintains independent hosted service operation while simplifying user account management to a single set of credentials.
Data Source
AI summary
A system and method for providing secure access to an organization's internal directory service from external hosted services. The system includes a remote directory service configured to accept directory service queries from an application running on hosted services. The remote directory service passes the queries to a directory service proxy server inside a firewall of the organization via a secure connection service. The directory service proxy server passes the queries to the internal directory service inside said firewall. Request responses from the internal directory service pass through the directory service proxy server to the remote directory service through said firewall via the secure connection service. The remote directory service returns the response to the requesting application.