Server-Computed Secret Authentication for Service Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Service providers face significant challenges in managing access authentication between services, leading to increased resource burdens and inefficiencies as the number of client services grows, particularly in managing authentication credentials across multiple servers.
Innovation Solution
A system that dynamically generates server-computed secrets for authenticating access, eliminating the need for storing authentication credentials by comparing service-specific secrets or their derivations against server-computed secrets, reducing resource consumption and operational costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used to manage access credentials across multiple servers, then authentication reliability is maintained, but device complexity and resource burden increase significantly
Solution Approach 1:
The patent extracts the authentication credential storage function from individual servers and relocates it to a centralized authentication server. This allows client services to authenticate without requiring credential storage on multiple servers, reducing device complexity while maintaining authentication reliability through centralized security management.
Solution Approach 2:
The authentication server is designed as a universal service that handles authentication for multiple client services through a single interface. This multi-functional approach eliminates the need for separate authentication mechanisms on each server, reducing overall system complexity while maintaining reliable authentication across all services.
2Adaptability or versatility
If authentication credentials are stored and managed across multiple servers, then authentication functionality is distributed, but resource burden and operational costs increase
Solution Approach 1:
The patent removes the credential storage function from distributed servers and consolidates it in a single authentication server. This extraction eliminates redundant storage resources across multiple servers while maintaining the ability to authenticate distributed client services, directly reducing resource burden and operational costs.
Solution Approach 2:
Instead of copying credentials across multiple servers, the patent uses a single master credential store in the authentication server that serves all client services. This single copy approach eliminates redundant data storage while maintaining universal access to authentication functionality across the distributed system.
3Reliability
If manual provisioning of authentication credentials is used, then security control is maintained, but productivity and setup time are reduced
Solution Approach 1:
The patent implements automatic credential generation and provisioning as a preliminary action before service deployment. The authentication server automatically generates credentials and configures client services without manual intervention, enabling rapid setup while maintaining security control through automated credential management and issuance.
Solution Approach 2:
The authentication system provides self-service capability where client services automatically obtain and manage their own authentication credentials through standardized API calls. This eliminates manual provisioning requirements while maintaining security through automated credential issuance and renewal processes.
Data Source
AI summary
An approach is presented for authenticating access by a service. The server receives a request, from a service, for the server, wherein the request includes, at least in part, a service-specific secret or a derivation of the service-specific secret. Further, the server determines to generate a server-computed secret. Then, the server determines to authenticate the request based, at least in part, on a comparison of the service-specific secret or the derivation of the service-specific secret against the server-computed secret or a derivation of the server-computed secret.The service receives credentials from a credential manager. The secret is part of the credentials. The credential manager and the server share some secret pre-configured data like key tables. The generation of the service specific secrets is based on the shared data.