Traffic Management Server Authentication Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer network security systems face challenges in defending against password-based attacks, particularly in environments where implementing multi-factor authentication (MFA) is difficult due to limitations in system integration and encryption protocols.
Innovation Solution
A network-security system, comprising a traffic-management server (TMS), is placed in front of directory servers to intercept and process authentication-related messages. The TMS can modify requests, require additional authentication, and enforce MFA policies without directly using the directory application, even when messages are encrypted using Active Directory authentication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional MFA solutions are implemented, then security against password-based attacks is improved, but system complexity and integration difficulty increase
Solution Approach 1:
The patent introduces a traffic management server as an intermediary component that sits between clients and directory servers. This server intercepts authentication traffic, inspects it for password-based attacks, and enforces MFA policies without requiring direct integration with the directory application. The intermediary handles the complexity of MFA enforcement, authentication traffic inspection, and policy decision-making, while the directory servers continue to operate with their existing authentication mechanisms unchanged.
2Reliability
If MFA is enforced through direct integration with directory applications, then authentication security is improved, but adaptability to different directory systems decreases
Solution Approach 1:
The patent segments the authentication system into distinct functional components: the traffic management server handles MFA enforcement and security policy implementation, while directory servers maintain their native authentication capabilities. This segmentation allows the MFA enforcement layer to be independent of specific directory system implementations, enabling the solution to work with multiple directory protocols and systems without requiring modifications to each directory application.
3Difficulty of detecting and measuring
If authentication traffic is monitored and inspected, then detection of malicious activity is improved, but processing time and system performance decrease
Solution Approach 1:
The traffic management server performs preliminary inspection and classification of authentication traffic before it reaches the directory servers. By pre-processing the traffic to identify potential threats and determine which connections require MFA enforcement, the system avoids full inspection of every authentication request. This preliminary action allows for optimized processing paths that reduce overall authentication latency while maintaining detection capabilities.
Data Source
AI summary
A directory server is configured to run a directory application, and while running the directory application, using one or more modules that are separate from the directory application, receive an authentication request directed to the directory application per an authentication process, forward the authentication request to a traffic-management server, receive the authentication request from the traffic-management server, in response to receiving the authentication request from the traffic-management server, pass the authentication request to the directory application, receive a response to the authentication request from the directory application, and in response to receiving the response from the directory application, communicate the response to the traffic-management server. The traffic-management server is configured to ascertain that the response indicates that the authentication request was granted, and in response to ascertaining that the response indicates that the authentication request was granted, intervene in the authentication process such that the authentication request is denied.