FAULT-TOLERANT AUTHENTICATION ARCHITECTURE THROUGH EXTERNAL IDENTITY PROVIDERS IN CRITICAL APPLICATIONS

Abstract

This paper examines the use of external identity providers (IdPs) in critical information infrastructure systems (CII), where failures or compromises of authentication mechanisms directly affect system availability and security. The objective of the study is to develop and experimentally validate a risk-based authentication architecture using OAuth 2.0 and OpenID Connect protocols that ensures resilience to external identity provider failures, secure token processing, compliance with privacy requirements, and continuity of a mission-critical application. The research methodology includes threat modeling, protocol vulnerability analysis, and experimental validation of the proposed architecture on a laboratory testbed. The test environment consists of a client application, an authentication gateway, a local IAM system, and an external IdP emulator with controlled failure scenarios (S1-S7). The experiments simulate degradation, complete unavailability, and compromise of the IdP, while evaluating key metrics such as availability, recovery time (RTO), and request latency. The proposed architecture is based on the principle of zero trust towards tokens, centralized validation, and controlled fallback mechanisms (fallback, step-up, break-glass, BCP). A threat verification model and quantitative evaluation metrics are introduced. The results demonstrate the feasibility of maintaining system access during IdP degradation and reducing token-related risks. The practical contribution lies in providing a reproducible approach to authentication design in mission-critical systems.