Session Synchronization via Alias Sessions in Identity Cloud
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity and access management systems in cloud environments face challenges in providing secure and seamless access across multiple devices, particularly in ensuring consistent security policies and managing access for various user types, including employees, customers, and partners, while preventing unauthorized access and breaches.
Innovation Solution
The implementation of a session synchronization mechanism across multiple devices through a 'Circle of Trust' device group, using microservices-based architecture for identity and access management, which enables secure access by replicating user sessions and enforcing unified security policies across devices, and integrating with existing on-premise systems for hybrid cloud deployments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If session synchronization is implemented across multiple devices, then user convenience and accessibility are improved, but system complexity and security management difficulty increase
Solution Approach 1:
The system segments session management by creating separate primary and alias sessions for different devices. The primary session handles core authentication while alias sessions manage device-specific access, allowing independent management of each device's session without affecting others.
Solution Approach 2:
The patent introduces an intermediary alias session mechanism that mediates between the user's primary authentication and multiple devices. The alias session acts as a bridge, containing authorization codes that enable seamless device switching while maintaining centralized security control.
2Adaptability or versatility
If multiple devices can access the same user account, then accessibility is improved, but security risk and unauthorized access potential increase
Solution Approach 1:
The system applies local quality by giving each device its own unique alias session with device-specific authorization codes and cryptographic keys. Each device maintains its own security context while being linked to the primary session, allowing differentiated security management for each device.
Solution Approach 2:
The patent creates cryptographic copies of authorization credentials through alias sessions. Each alias session contains a copied authorization code derived from the primary session but encrypted with device-specific keys, enabling secure replication of access rights across multiple devices without exposing the primary credentials.
3Ease of operation
If session replication is implemented across devices, then user experience consistency is improved, but network bandwidth and processing resources are consumed
Solution Approach 1:
The system extracts only the essential session information needed for device switching by transferring authorization codes in a compact format. Instead of replicating entire session states, the alias sessions contain minimal necessary data (authorization codes and device identifiers), reducing network bandwidth consumption while maintaining user experience consistency.
Data Source
AI summary
Embodiments provide session synchronization across multiple devices. Embodiments receive, at a single sign-in (“SSO”) service, user credentials from a user in response to the user signing into the first device. In response to receiving the user credentials, embodiments create a primary SSO session by the SSO service. In response to an attempt by the second device to create another SSO session, subsequent to the creating of the primary SSO session, embodiments create an alias SSO session linked to the primary SSO and set an encrypted session cookie containing the alias SSO session and returning an authorization code including the alias SSO session to the second device. Embodiments verify the second token using a second public key of the second device and send user information of the user to the second device, where the second device uses the user information to automatically sign the user into the second device.