Application-Specific Session Authentication via Token Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional session authentication methods in cloud platforms often lead to security risks by authenticating the entire browser session, allowing unauthorized access to resources, and fail to maintain secure sessions across web domains for single-page applications.
Innovation Solution
Implementing application-specific session authentication using session-identifying tokens, such as OAUTH tokens, which are included only in resource requests from trusted applications, allowing secure access to resources without granting access to the entire browser session, and utilizing cross-domain storage to maintain sessions across web domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional session authentication is used to authenticate user devices, then access to resources is enabled, but the entire browser session is authenticated allowing unauthorized access to resources
Solution Approach 1:
The patent segments the authentication scope from browser-level to application-level by introducing application-specific session identifiers. Instead of authenticating the entire browser session, the system creates separate authentication contexts for each embedded application, allowing fine-grained control over which applications can access which resources.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism using session identifiers and authentication tokens that mediate between the user device and resources. These intermediaries (session identifiers, authentication tokens) act as credentials that embedded applications must present to access resources, preventing direct unauthorized access while maintaining secure authentication.
2Reliability
If application-specific session authentication is implemented using session-identifying tokens, then secure access is granted to embedded applications, but session maintenance across web domains becomes complex
Solution Approach 1:
The patent implements universality by designing session identifiers and authentication tokens that function consistently across different web domains. The same authentication mechanism works whether the embedded application is accessed from a single domain or multiple domains, providing uniform authentication behavior without requiring domain-specific handling logic.
Solution Approach 2:
The patent uses copying by replicating session identifiers and authentication tokens across different web domains. When a user accesses an embedded application from multiple domains, the system copies the relevant authentication state to maintain the session across domains, enabling seamless multi-domain access while preserving security.
3Adaptability or versatility
If embedded applications need to access resources from host servers, then application functionality is enabled, but security risks increase when entire browser sessions are authenticated
Solution Approach 1:
The patent applies local quality by assigning application-specific authentication credentials rather than using a single global authentication mechanism. Each embedded application receives its own session identifier and authentication token, creating localized authentication contexts that prevent other applications or scripts from accessing resources, thereby reducing security risks while maintaining application functionality.
Data Source
AI summary
Methods, systems, and devices for application-specific session authentication are described. In some systems, a host server may authenticate a single-page application utilizing token-based verification. For example, a user device running the single-page application embedded within a container webpage may transmit a resource request including a session-identifying token to the host server. The host server may identify whether the session-identifying token is included in the resource request from the single-page application in order to determine whether to grant resource access for the request. If the request includes the token, the host server may determine that the request is from the single-page application, and may transmit the requested resources to the user device to load or update the embedded application. Using the token-based scheme, the host server may grant access to requests from the specific application, while restricting resource access to any requests received from other entities of the user device.