Non-Extractable Asymmetric Keys for Secure Browser SSO
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Single sign-on (SSO) systems using cookies or bearer tokens are vulnerable to man-in-the-middle attacks and session hijacking due to the extractability and theft of credentials, compromising security.
Innovation Solution
Implementing secure single sign-on capabilities using asymmetric cryptography, where non-extractable private keys are stored in the client's web browser and used to sign requests, eliminating the need for cookies or bearer tokens, thereby enhancing security and scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cookies or bearer tokens are used for single sign-on, then single sign-on functionality is achieved, but security is compromised due to extractability and theft of credentials
Solution Approach 1:
The patent applies asymmetry by using asymmetric cryptography (public-private key pairs) instead of symmetric authentication mechanisms. The server holds the private key and the client holds the public key, creating an asymmetric relationship where the client can prove authentication without exposing secret credentials that can be stolen. This resolves the contradiction by maintaining single sign-on functionality while eliminating the security vulnerability of extractable tokens.
Solution Approach 2:
The patent extracts the secret verification mechanism from the client side and places it entirely on the server side. The private key never leaves the server, and only public keys or signed proofs are transmitted to the client. This extraction of the secret from the authentication flow eliminates the security risk while preserving single sign-on capability.
2Ease of operation
If cookies are sent to server for validation, then session tracking is enabled, but vulnerability to man-in-the-middle attacks and session hijacking increases
Solution Approach 1:
The patent introduces cryptographic proofs as an intermediary mechanism between the client and server for session validation. Instead of directly transmitting cookies that can be intercepted, the system uses signed proofs generated by the client and verified by the server through cryptographic validation. This intermediary layer prevents man-in-the-middle attacks while maintaining session tracking functionality.
Solution Approach 2:
The patent replaces the mechanical cookie transmission and validation system with a cryptographic verification system. Instead of relying on opaque cookies that must be trusted and protected during transmission, the system uses mathematical proofs that can be verified without exposing secrets. This substitution eliminates the vulnerability to session hijacking while preserving ease of session management.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are provided for establishing a session with an application using asymmetric cryptography. Techniques include secure single-sign on capabilities using asymmetric cryptography. With asymmetric signatures, the use of browser local storage and the Web Crypto application programming interface (API), the key cannot be extracted from the browser that it was generated for. The mechanism allows a web domain to track a user login session using a non-extractable asymmetric key stored in the client's web browser, and leverage the non-extractable asymmetric key for single sign-on.