Username Segmentation for Identity Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large organizations, managing username changes across multiple directories and databases is cumbersome due to the proliferation of multiple username copies, requiring updates in each system, which complicates user identity management and secure access to network resources.
Innovation Solution
Implementing a system with a user-record database that maintains both an immutable and a modifiable username, where the user can change the modifiable username without affecting the immutable one, allowing secure access using either username, and ensuring that only the modifiable username is updated, thus simplifying the process of username changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple copies of username are maintained in different databases and systems, then username changes require updates across all databases and systems, but this ensures consistent authentication and authorization across the organization
Solution Approach 1:
The patent segments the username into two distinct types: a immutable reference username stored in the authentication directory, and a modifiable alias username stored in the authorization directory. This segmentation allows the reference username to remain stable for authentication consistency while the alias username can be changed without affecting other systems, thereby resolving the contradiction between maintaining authentication reliability and reducing management complexity.
Solution Approach 2:
The authorization directory acts as an intermediary between the authentication directory and the various application databases. It stores alias usernames that map to reference usernames, serving as a mediator that translates between the stable reference identifier and the changeable alias identifier. This intermediary structure allows username changes to be isolated to the authorization directory without propagating to authentication directories or application databases.
2Reliability
If username is changed in all databases and systems, then user identity remains consistent across the organization, but the process becomes cumbersome and time-consuming
Solution Approach 1:
By segmenting usernames into immutable reference identifiers and changeable alias identifiers, the system allows users to change only their alias username in the authorization directory without requiring updates to the authentication directory or application databases. This significantly reduces the time and effort needed for username changes while maintaining identity consistency through the mapping relationship between alias and reference usernames.
Solution Approach 2:
The system performs preliminary action by establishing the mapping relationship between alias usernames and reference usernames in advance through the authorization directory. This pre-configured mapping structure enables rapid username changes without requiring real-time updates across multiple databases, as the authorization directory already contains the necessary mapping information to translate between alias and reference identifiers.
3Ease of operation
If a single username is used across all systems, then username changes are simple, but secure access requires multiple username copies in different databases
Solution Approach 1:
The patent applies segmentation by dividing the username functionality into two separate storage locations with distinct characteristics: the authentication directory stores the immutable reference username, while the authorization directory stores the modifiable alias username. This segmentation allows the system to maintain multiple username copies for secure access while providing ease of operation through isolated updates in the authorization directory only.
Solution Approach 2:
The system applies local quality by assigning different properties to different username storage locations: the authentication directory maintains the reference username with immutability properties for secure authentication, while the authorization directory maintains the alias username with modifiability properties for easy changes. Each location has the appropriate quality characteristics for its specific function, resolving the contradiction between operational simplicity and database complexity.
Data Source
Figure 1~2
AI summary
A method for secure access to a resource including the steps of receiving a user request associated with a username for access to a resource; checking the username associated with the request against a reference username associated with the user; in which the reference username is linked to a second username associated with the user; if the received username matches the reference username, modifying the request by replacing the received username with the second username; and forwarding the modified request towards the resource. A new username can be recorded upon receiving a request from the user. In response to the received request, the new username is recorded at a reference location linked to the location of the second username.