Non-Extractable Asymmetric Keys for Secure Browser SSO

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Single sign-on (SSO) systems using cookies or bearer tokens are vulnerable to man-in-the-middle attacks and session hijacking due to the extractability and theft of credentials, compromising security.

Innovation Solution

Implementing secure single sign-on capabilities using asymmetric cryptography, where non-extractable private keys are stored in the client's web browser and used to sign requests, eliminating the need for cookies or bearer tokens, thereby enhancing security and scalability.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If cookies or bearer tokens are used for single sign-on, then single sign-on functionality is achieved, but security is compromised due to extractability and theft of credentials

Engineering Contradiction:
Improvesingle sign-on functionalityVSAvoidsecurity
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The patent applies asymmetry by using asymmetric cryptography (public-private key pairs) instead of symmetric authentication mechanisms. The server holds the private key and the client holds the public key, creating an asymmetric relationship where the client can prove authentication without exposing secret credentials that can be stolen. This resolves the contradiction by maintaining single sign-on functionality while eliminating the security vulnerability of extractable tokens.

Inventive Principle:
Principle #4Asymmetry

Solution Approach 2:

The patent extracts the secret verification mechanism from the client side and places it entirely on the server side. The private key never leaves the server, and only public keys or signed proofs are transmitted to the client. This extraction of the secret from the authentication flow eliminates the security risk while preserving single sign-on capability.

Inventive Principle:
Principle #2Taking out (Extraction)

2Ease of operation

If cookies are sent to server for validation, then session tracking is enabled, but vulnerability to man-in-the-middle attacks and session hijacking increases

Engineering Contradiction:
Improvesession trackingVSAvoidman-in-the-middle attacks and session hijacking
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces cryptographic proofs as an intermediary mechanism between the client and server for session validation. Instead of directly transmitting cookies that can be intercepted, the system uses signed proofs generated by the client and verified by the server through cryptographic validation. This intermediary layer prevents man-in-the-middle attacks while maintaining session tracking functionality.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical cookie transmission and validation system with a cryptographic verification system. Instead of relying on opaque cookies that must be trusted and protected during transmission, the system uses mathematical proofs that can be verified without exposing secrets. This substitution eliminates the vulnerability to session hijacking while preserving ease of session management.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentEP3915026B1Browser login sessions via non-extractable asymmetric keys
Publication Date: 2022.12.14 ORACLE INT CORP
  • EP3915026B1 patent drawingFigure 1
  • EP3915026B1 patent drawingFigure 2
  • EP3915026B1 patent drawingFigure 3

AI summary

Techniques are provided for establishing a session with an application using asymmetric cryptography. Techniques include secure single-sign on capabilities using asymmetric cryptography. With asymmetric signatures, the use of browser local storage and the Web Crypto application programming interface (API), the key cannot be extracted from the browser that it was generated for. The mechanism allows a web domain to track a user login session using a non-extractable asymmetric key stored in the client's web browser, and leverage the non-extractable asymmetric key for single sign-on.