Single Sign-On Token Translation Across Independent Login Protocols
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Customers subscribing to multiple cloud services from a CSP face an unsatisfactory user experience and increased security risks due to separate login procedures and credentials for different identity management systems, such as IAM and IDCS, which use different protocols and protocols.
Innovation Solution
A single sign-on mechanism is developed to integrate these systems, allowing users to log in once and seamlessly access both IAM and IDCS applications, using a public/private key pair and OAuth flows to translate tokens and manage credentials transparently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate login procedures are used for different cloud services, then each system can maintain its own security and control, but user experience deteriorates and security risks increase
Solution Approach 1:
The patent introduces an intermediary authentication system that acts as a mediator between multiple independent cloud services. This intermediary system receives authentication requests from various cloud services, validates user credentials centrally, and issues authentication tokens that can be used across different services. This resolves the contradiction by maintaining security through centralized validation while enabling seamless access across multiple services without requiring separate login procedures for each service.
Solution Approach 2:
The authentication system is designed with universal functionality to serve multiple cloud services through a single unified authentication mechanism. The system can authenticate users for different cloud services using the same credential validation process and token issuance mechanism, allowing one set of credentials to access multiple services. This multi-functionality resolves the contradiction by enabling consistent security practices across all services while eliminating the need for service-specific login procedures.
2Reliability
If multiple separate credentials are required for different systems, then each system can be secured independently, but the complexity of credential management increases
Solution Approach 1:
The intermediary authentication system serves as a mediator that manages credential validation and token issuance centrally. Instead of each cloud service maintaining its own credential storage and validation logic, the intermediary system provides a unified credential management function. This reduces the complexity of credential management while maintaining independent system security, as the intermediary handles the complexity of credential validation and token generation across multiple services.
Solution Approach 2:
The patent extracts the credential management functionality from individual cloud services and consolidates it into a separate intermediary authentication system. By taking out the credential validation and token issuance functions from each service, the system reduces the complexity burden on individual services while maintaining their security independence. The intermediary system handles the complex tasks of credential validation and token management centrally.
3Adaptability or versatility
If different login protocols are used for different cloud services, then each service can optimize for its specific requirements, but integration and seamless access become difficult
Solution Approach 1:
The intermediary authentication system acts as a protocol translator and mediator between cloud services with different login requirements. It receives authentication requests from services using their specific protocols, validates credentials according to service requirements, and issues standardized authentication tokens. This resolves the contradiction by allowing each service to maintain its optimized login protocol while the intermediary provides a unified interface for seamless access across services.
Solution Approach 2:
The authentication system is segmented into separate functional components: service-specific authentication handlers that optimize for individual service requirements, a central validation engine that processes credentials, and a token issuance mechanism that provides unified access. This segmentation allows each component to be optimized independently while working together to provide seamless integration, resolving the contradiction between service-specific optimization and integration simplicity.
Data Source
AI summary
Systems and methods for single sign-on between two independent systems are disclosed herein. The method can include receiving a request to access a first application of a first system having a first login protocol. The method can include receiving user login credentials and authenticating the user login credentials. The method can include logging the user in to the first system and a second system based on the received login credentials. The second system can have a second login protocol independent of the first login protocol.