Server Password Manager for Unattended Application Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems for computer resources, such as hard-coded passwords and User Identity Management, Public Key Infrastructures, and Kerberos, fail to provide unattended authentication and secure credential management for applications, leading to vulnerabilities and increased maintenance costs.
Innovation Solution
A system comprising a Server Password Manager (SPM) module and a Credentials Manager (CM) module, where the SPM creates and encrypts a request package with fingerprint data and sends it to the CM for decryption and validation, allowing unattended authentication and secure access to resources without human intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If hard-coded passwords are used for application authentication, then applications can access resources, but security vulnerabilities increase due to clear-text storage and distribution requirements
Solution Approach 1:
The patent extracts the password management function from the application itself by introducing a separate Credentials Manager module. The application no longer contains hard-coded passwords; instead, it requests credentials dynamically from the Credentials Manager, which stores and manages them securely. This separation eliminates the security vulnerability of hard-coded clear-text passwords while maintaining application access capability.
Solution Approach 2:
The patent introduces an intermediary module called the Credentials Manager that acts as a mediator between applications and resources. Instead of applications directly using hard-coded passwords to access resources, they go through the Credentials Manager which provides authenticated credentials. This intermediary layer eliminates the need for applications to store or transmit passwords, thereby removing the security vulnerability while preserving access functionality.
2Reliability
If User Identity Management systems are used for authentication, then user access control is improved, but unattended application authentication fails due to reliance on manual user interaction
Solution Approach 1:
The patent implements self-service authentication for applications by enabling the Credentials Manager to automatically provide credentials to applications without requiring manual user interaction. The system performs self-verification through cryptographic authentication between the application and Credentials Manager, allowing unattended applications to authenticate automatically while maintaining secure access control similar to User Identity Management systems.
3Reliability
If Public Key Infrastructures are used for authentication, then authentication security is improved, but system complexity increases due to key management and integration requirements
Solution Approach 1:
The patent merges the authentication security benefits of Public Key Infrastructure with the simplicity of password-based systems by integrating cryptographic verification into the Credentials Manager. Instead of requiring separate PKI infrastructure with certificate management and key storage, the system combines cryptographic authentication mechanisms directly within the existing credential management framework, achieving high security without the complexity of full PKI implementation.
4Reliability
If credentials are changed frequently to improve security, then security vulnerability decreases, but maintenance costs and application outages increase
Solution Approach 1:
The patent implements preliminary action by having the Credentials Manager pre-generate and store multiple credentials for each resource ahead of time. When an application needs to access a resource, the Credentials Manager provides a fresh credential without requiring any changes to be propagated to the application. This eliminates the maintenance burden and potential outages associated with frequent credential changes, while still providing strong security through regularly rotated credentials managed centrally.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for unattended authentication of software applications to provide these applications with access to shared resources. A server password manager (SPM) module resident on a node also occupied by a requestor software application requesting access to resources receives the requestor's request. The SPM module creates a request package containing the requestor's information as well as the node's identifying information. The request package is then transmitted to a credentials manager (CM) module in a CM node. The request package, encrypted by the SPM module with encryption keys previously generated by the CM module, is decrypted by the CM module. The contents are checked against data stored by the CM module regarding the SPM module and the requestor application when these were registered with the CM. If the data matches, then the CM provides credentials which are used to give the requestor application access to the requested resources.