Trusted Database Authentication Through Untrusted Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for creating mashups introduce security concerns due to the same-origin policy, forcing Web applications to sacrifice security or functionality, and untrusted intermediaries cannot efficiently validate and submit user credentials to data sources, especially when credentials are not in the same format or domain as the data source.
Innovation Solution
A system that uses a security token service (STS) to generate and validate user credentials of the required type and format, allowing an untrusted intermediary to access a data source by transforming credentials if necessary, and validating them with a local authentication service, even if the STS and data source are in different management domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an untrusted intermediary is used to access data sources, then functionality and creative freedom are improved, but security and trustworthiness deteriorate
Solution Approach 1:
The patent introduces a trusted authentication service as an intermediary between the untrusted mashup intermediary and the data source. This mediator validates user credentials and issues authentication tokens that the data source can trust, allowing the untrusted intermediary to access secure resources without compromising security. The authentication service acts as a bridge that resolves the trust issue while maintaining functionality.
2Ease of operation
If user credentials are stored with an untrusted mashup intermediary, then ease of operation is improved, but security deteriorates due to potential compromise
Solution Approach 1:
The patent extracts the authentication credentials from the untrusted intermediary environment and stores them securely in the user's trust client. Instead of the intermediary holding sensitive credentials, the system separates credential storage (in the user's secure environment) from authentication execution (performed by the authentication service). This extraction eliminates the security risk while maintaining ease of operation.
Solution Approach 2:
The authentication service serves as an intermediary that retrieves credentials securely from the user's trust client, validates them, and returns authentication tokens to the data source. This mediator approach allows easy operation without the untrusted intermediary ever possessing the actual credentials, thus maintaining both usability and security.
3Reliability
If the same-origin policy is enforced, then security is improved, but functionality deteriorates due to restrictions on data access
Solution Approach 1:
The authentication service acts as a trusted intermediary that bypasses same-origin policy restrictions. When the authentication service validates credentials and issues tokens, the data source trusts these tokens regardless of the originating domain. This allows mashup intermediaries from different domains to access data sources securely without violating the same-origin policy, maintaining both security and functionality.
4Measurement precision
If credentials must be in the same format and domain as the data source, then validation precision is improved, but adaptability deteriorates
Solution Approach 1:
The authentication service performs parameter transformation by converting credentials from various formats and domains into a standardized format that the data source can validate. The service changes the parameters (format, domain) of the credentials while preserving their authentication meaning, allowing precise validation regardless of the original credential format. This enables the system to accept diverse credential types while maintaining strict validation standards.
Data Source
AI summary
A method, system and computer-usable medium are disclosed for validating user credentials submitted to a data source by an untrusted intermediary. An untrusted intermediary attempts to access a data source on behalf of a user. The untrusted intermediary challenges the user to provide credentials of the type and format required to access the data provided by the data source. The user's trust client connects to an authentication service and identification credentials of the required type and format are generated. The identification credentials are conveyed to the user's trust client, which then provides them to the user's client, which in turn conveys them to the untrusted intermediary. The untrusted intermediary then presents the identification credentials to an authentication plug-in of the data source. The authentication plug-in validates the authenticity of the provided credentials with their associated authentication service. Once the credentials are successfully validated, the requested data is provided to the user's client by the untrusted intermediary.