Enterprise Authentication via Access Token Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for users on mobile devices and other client devices in enterprise systems are insecure, requiring frequent re-authentication and managing multiple sets of credentials, which complicates access to various resources and services.
Innovation Solution
Implementing a system that uses an access manager to validate mobile applications and create validation data and access tokens, allowing for secure and simplified authentication by using user secrets instead of full credentials, reducing the need for frequent re-authentication and managing multiple credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional authentication methods are used with full credentials, then security is maintained, but users must frequently re-authenticate and manage multiple credential sets
Solution Approach 1:
The patent segments authentication credentials into two parts: validation data stored securely in the enterprise system and access tokens stored locally on the client device. This segmentation allows the client to present only the access token for authentication, eliminating the need to repeatedly transmit full credentials while maintaining security through the server-held validation data.
Solution Approach 2:
The system performs preliminary authentication by validating the client device and generating an access token before the user needs to access resources. This preliminary action stores the authentication result in the client device, allowing subsequent access without repeated full credential entry, thus improving convenience while maintaining security through the server-validated token.
2Reliability
If full authentication credentials are transmitted frequently, then authentication can be verified, but security risks increase and user experience deteriorates
Solution Approach 1:
The patent extracts the sensitive part of authentication (validation data) and keeps it securely stored in the enterprise system, while only transmitting the non-sensitive access token to the client device. This extraction eliminates the need to repeatedly transmit full credentials, reducing security risks while maintaining verification capability through the token-validation mechanism.
3Adaptability or versatility
If multiple credential sets are managed for different resources, then access control is precise, but device complexity and user burden increase
Solution Approach 1:
The access token serves multiple functions: it authenticates the user, authorizes resource access, and can be used across different enterprise resources. This universal token replaces the need for multiple credential sets, simplifying credential management while maintaining precise access control through the token's embedded authorization information.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems for authenticating users of client devices to allow access of resources and services in enterprise systems are described herein. An authentication device may validate a user based on authentication credentials received from a client device. Validation data stored by the authentication device, and a corresponding access token transmitted to the client device, may be used to authenticate the user for future resource access requests. A user secret also may be stored by the authentication device and used to validate the user for future resource access requests. Additionally, after validating a user with a first set of authentication credentials, additional sets of credentials for the user may be retrieved and stored at an access gateway for future requests to access other services or resources in an enterprise system.