Token-Based Authentication for Service Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ensuring secure access to computing resources across multiple geographic networks and services is challenging due to the complexity and size of configurations, requiring efficient authentication and authorization mechanisms to prevent unauthorized access.
Innovation Solution
Implementing a centralized authentication system that uses electronic signatures and service-wide and service-specific information to verify requests, allowing services to determine authenticity without direct communication with the authentication service, thereby reducing the load on the authentication system and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized authentication system verifies all requests directly, then security is maintained, but the authentication system becomes a bottleneck and increases latency
Solution Approach 1:
The patent segments the authentication process into two phases: a centralized authentication phase where the authentication service verifies credentials and issues tokens, and a decentralized verification phase where individual services verify tokens independently. This segmentation allows the authentication system to remain centralized for security while enabling fast, independent verification at each service, thereby reducing overall latency.
Solution Approach 2:
The patent introduces an intermediary token as a mediator between the centralized authentication system and individual services. The token carries authentication information that allows services to verify requests without direct communication with the authentication service, reducing latency while maintaining security through the intermediary's embedded verification credentials.
2Reliability
If the authentication system communicates with every service directly, then authorization accuracy is maintained, but the system complexity and communication overhead increase
Solution Approach 1:
The patent extracts the essential authentication verification capability from the centralized authentication service and embeds it within the token itself. This allows individual services to perform authorization decisions locally using the extracted verification information, reducing system complexity by eliminating the need for continuous centralized communication while maintaining accurate authorization.
Solution Approach 2:
The patent creates a universal token format that can be verified by multiple different services without requiring service-specific authentication protocols. The token's standardized structure with embedded verification credentials enables any service to authenticate requests independently, simplifying the overall system architecture while maintaining consistent authorization accuracy across all services.
3Reliability
If services communicate directly with the authentication service for each request, then authentication security is maintained, but network resources are consumed excessively
Solution Approach 1:
The patent performs the authentication verification action in advance during the token issuance phase, where the authentication service pre-verifies credentials and embeds verification information in the token before the actual request occurs. This preliminary action shifts the computational burden from request-time communication to token-creation time, reducing network resource consumption during request processing while maintaining security.
Solution Approach 2:
The patent creates a copy of the authentication verification capability within the token itself, allowing services to perform verification locally without contacting the authentication service for each request. This copying of verification information reduces network resource consumption by eliminating repeated communication while maintaining authentication security through the copied verification credentials.
Data Source
AI summary
A service provider manages access control to multiple services through an authentication system. One or more services are able to fulfill requests at least in part by submitting requests to other services of the service provider. Such a service is able to obtain, from the authentication system, information that can be passed on to one or more other services to enable the one or more other services to determine request validity without having to contact the authentication system. The information may include, for example, one or more responses that the one or more other services would have received had the one or more services contacted the authentication system themselves.