Security Gateway Client Authentication via SSO
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face challenges in authenticating client devices effectively, particularly in mobile environments, due to the complexity of distributing unique keys or certificates and the lack of built-in support for client-side certificate management in new devices like smartphones.
Innovation Solution
Implementing a Security Gateway that leverages application-related authentication by using a DNS server to redirect requests to a Security Gateway, which then authenticates clients using a Single Sign On (SSO) server with username and password verification, creating a mutually authenticated secure connection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If client-side authentication using certificates or pre-shared keys is implemented, then network security is improved, but device complexity and key distribution complexity increase
Solution Approach 1:
The patent introduces a server-side authentication mechanism as an intermediary between the client and the network. Instead of requiring clients to manage their own certificates, the server performs authentication using its own private key, simplifying the client-side implementation while maintaining security. This mediator approach transfers the complexity from client devices to the server infrastructure.
Solution Approach 2:
The patent inverts the traditional authentication paradigm by having the server authenticate the client rather than the client authenticating itself. This inversion eliminates the need for clients to store and manage certificates, as the server uses its private key to verify client identity, thereby reducing device complexity while enhancing security.
2Reliability
If mutual authentication is implemented, then network security is improved, but ease of operation deteriorates due to complex certificate distribution requirements
Solution Approach 1:
The server performs self-service authentication by using its own private key to verify client identities. This eliminates the need for manual certificate distribution to clients, as the server independently handles authentication without requiring clients to obtain or install certificates. The system serves itself by leveraging the server's pre-configured private key.
Solution Approach 2:
The server acts as an intermediary that handles the authentication complexity centrally. Instead of distributing certificates to multiple clients, the server uses its private key as a mediator to authenticate clients, simplifying the operational process while maintaining mutual authentication capabilities.
3Reliability
If client-side authentication is implemented on new devices, then network security is improved, but adaptability deteriorates due to lack of built-in support in new operating systems
Solution Approach 1:
The patent inverts the authentication approach to work backwards from the server's perspective. Instead of requiring clients to have built-in certificate management capabilities, the server uses its private key to authenticate clients, making the system adaptable to any device regardless of its built-in authentication capabilities.
Solution Approach 2:
The server's private key serves as a universal intermediary that can authenticate any client device. This approach eliminates the need for device-specific certificate management and works across different operating systems and device types, enhancing adaptability while maintaining security.
Data Source
AI summary
Exemplary network infrastructures and methods employing a Security Gateway utilize client authentication for use of a secure connection between an application client and an application server of a protected network. Once a secure connection has been set up, a Security Gateway can start a timer for establishing a period within which a password and username are to be received from the application client before traffic is allowed to exit the Security Gateway. If a username and password are provided while the timer is running, the Security Gateway can contact a single sign on (SSO) server to check whether the username and password are correct. If the username and password are valid, the Security Gateway can start relaying traffic externally to the application server. If an invalid username and password are provided or the timer times out before receipt of a username and password, the secure connection can be terminated.