Embedding SSPI in Communications Library for Secure Client-Server Auth
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Standardization of security profiling in complex network and multi-legacy environments is challenging due to the need for a multi-step SSPI handshake and individual message protection in current database management systems, which complicates client-server communication and security management.
Innovation Solution
Embedding the Microsoft Security Support Provider Interface (SSPI) within a communications class library to enable peer authentication, message signing, and encryption, allowing for a single-step authentication process and transparent encryption/decryption of messages between clients and servers, with the communications library providing methods to toggle security features on and off.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSPI is used for security authentication in client-server communication, then security protection is improved, but the complexity of the authentication process increases due to multi-step handshake and individual message protection requirements
Solution Approach 1:
The patent embeds SSPI security functions within the communications class library, nesting the security provider interface inside the communication object. This allows the complex SSPI authentication and encryption functions to be contained within a simpler communication interface, resolving the contradiction by hiding complexity internally while maintaining security functionality.
Solution Approach 2:
The communications class library acts as an intermediary between the application and SSPI security functions. Instead of applications directly handling complex SSPI handshakes and message protection, the library mediates these interactions, simplifying the interface while maintaining robust security authentication.
2Reliability
If SSPI functions are individually called for each message protection, then security integrity is improved, but the time required for communication increases
Solution Approach 1:
The patent performs authentication and security setup in advance during the connection establishment phase, rather than handling each message individually. The SSPI functions are configured and initialized beforehand, allowing messages to be transmitted with pre-established security parameters, thus reducing per-message overhead time while maintaining integrity.
3Reliability
If applications directly handle SSPI functions, then security control is improved, but the ease of operation decreases due to complex security management requirements
Solution Approach 1:
The patent extracts complex SSPI security management functions from the application layer and relocates them to the communications class library. Applications no longer need to directly manage SSPI functions; instead, they utilize simplified library methods that automatically handle authentication and encryption, improving ease of operation while maintaining security control through the library's implementation.
Solution Approach 2:
The communications class library provides self-service security management, automatically handling authentication, encryption, and decryption operations without requiring application-level intervention. The library manages security parameters and SSPI functions autonomously, making security operations transparent to applications while maintaining robust control.
Data Source
AI summary
An apparatus for and method of improving the efficiency of service request/response activity requiring security functions. A security facility, such as Security Support Provider Interface is embedded in a communication class library which controls the communication between client and server applications. A context token is associated with the service request which specifies the security functions to be provided in honoring that particular request without any particular attention by either client or server application, as the security functions are exclusively concerned with the communication process rather than the service request/response activity.