Single Sign-On Host Process Bypasses Firewall Token Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single sign-on systems face challenges in implementing secure authentication across different domains and networks, particularly when policy servers are placed behind firewalls, making it difficult for third-party applications to authenticate users and validate tokens.
Innovation Solution
A single sign-on system that uses a host process to initially authenticate users and validate tokens, allowing secure communication between the host process and policy server, and then grants access to computing resources, thereby bypassing potential firewall issues and enabling seamless authentication across different domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If policy servers are placed behind firewalls for security, then security is improved, but third-party applications cannot directly communicate with policy servers to validate tokens
Solution Approach 1:
The patent introduces a host process as an intermediary component that receives token validation requests from third-party applications and forwards them to the policy server. This mediator architecture allows the policy server to remain behind firewalls for security while still enabling token validation through the host process, which acts as a trusted gateway between external applications and the protected policy server.
2Device complexity
If direct communication between applications and policy servers is allowed, then token validation is simplified, but security risks increase
Solution Approach 1:
The host process serves as a secure intermediary that manages all communications between third-party applications and the policy server. Applications do not directly contact the policy server; instead, they submit tokens to the host process, which then validates them through the secured channel to the policy server, maintaining security while enabling simplified authentication for applications.
Solution Approach 2:
The system segments the authentication process into distinct components: the host process handles application interactions and token management, while the policy server handles credential verification and token issuance. This segmentation allows each component to specialize in its function, with the host process acting as a secure gateway that protects the policy server from direct external access.
3Adaptability or versatility
If multiple authentication systems are implemented across different domains, then authentication coverage is improved, but system complexity and costs increase
Solution Approach 1:
The host process implements a universal authentication interface that works across multiple domains and third-party applications. By providing a standardized token validation mechanism that the policy server can verify, the system enables broad authentication coverage without requiring each application or domain to implement its own separate authentication infrastructure, thus reducing overall system complexity.
Data Source
AI summary
A computer-readable storage medium having computer-executable instructions for authenticating in a computing environment where the computer-executable instructions instruct a processor to receive a token from a client by a first process, send the token to a second process, validate the token by the second process by sending the token to a policy server and receiving a validation of the token from the policy server, and selectively grant access to the computing resource based at least in part upon the validation of the token. The validation of the token indicates that the token is associated with a previous successful authentication of the client by the second process. A system also includes the first process and the second process.