Account Parameter Passing for Secure Cross-Application Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in seamlessly transitioning between applications on a client device, leading to confusion and potential unauthorized access to multiple accounts, especially when multiple accounts are signed onto a single device.
Innovation Solution
The method involves using an authentication server to provide an account parameter derived from an account credential to a client device, which is then embedded in a link or passed via an activity function call to another application, allowing for secure authentication and account parameter transfer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple applications are allowed to access multiple accounts on a single client device, then account versatility and functionality are improved, but security risks and unauthorized access potential increase
Solution Approach 1:
The patent introduces an authentication server as an intermediary between the client device and multiple applications. The authentication server receives authentication requests from applications, verifies credentials, and returns authentication tokens. This mediator architecture allows multiple applications to access multiple accounts securely without exposing raw credentials, resolving the contradiction by enabling versatility while maintaining security through centralized authentication management.
Solution Approach 2:
The patent extracts the authentication logic from individual applications and centralizes it in a dedicated authentication server. By separating the authentication function from application logic, the system enables multiple applications to access multiple accounts without each application needing to handle sensitive credentials directly. This extraction improves security while maintaining account access versatility.
2Ease of operation
If seamless transitions between applications are implemented using shared credentials, then user convenience is improved, but the risk of unauthorized access and account confusion increases
Solution Approach 1:
The patent implements a token copying mechanism where the authentication server creates authentication tokens that can be passed between applications. Instead of sharing actual credentials, the system creates secure copies (tokens) that represent authenticated sessions. These tokens can be embedded in links or passed via activity function calls, enabling seamless transitions while maintaining security through token-based authentication rather than credential sharing.
Solution Approach 2:
The patent transforms authentication credentials into different parameter forms (authentication tokens) that can be safely transmitted between applications. By changing the parameter representation from raw credentials to encrypted tokens, the system enables smooth transitions while eliminating the security risks associated with credential sharing. The tokens can be embedded in URL parameters or passed through function calls without exposing sensitive information.
3Speed
If account credentials are passed directly between applications, then authentication speed is improved, but security and privacy concerns worsen
Solution Approach 1:
The authentication server acts as an intermediary that receives credentials from the first application, processes authentication, and returns tokens to the second application. This mediator approach maintains fast authentication by eliminating manual re-entry while protecting privacy by never exposing raw credentials between applications. The server handles sensitive credential processing securely while enabling rapid token-based authentication between applications.
Data Source
AI summary
Systems and methods for passing account authentication information via parameters. A server can provide, to a client device, an account parameter derived from an account credential used to authenticate a first application to insert into a link. The link can include an address referencing a second application. The account parameter can be passed from the first application to the second application responsive to an interaction on the link. The server can receive from the second application of the client device, subsequent to passing the account parameter from the first application to the second application, a request to authenticate the second application including the account parameter. The server can authenticate the client device for the second application using the account parameter. The server can transmit, responsive to authenticating the client device for the second application, an authentication indication to the second application of the client device.