Authentication Service for Secure Shared Credential Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional user authentication methods for shared credentials among multiple users lack security, as they fail to control access effectively and track which user is using the account at any given time, leading to potential misuse and inefficient revocation processes.
Innovation Solution
An authentication service that securely manages shared credentials by providing access only when specified conditions are met and automatically modifying credentials upon revocation, ensuring secure distribution and tracking of user access within the authentication service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If multiple users share a username and password for an online account, then access is granted to multiple users, but security problems arise and information is lost about which user is using the account
Solution Approach 1:
The patent segments the shared credential into two separate components: a static credential (username or email) that identifies the account, and a dynamic credential (one-time password or time-limited access token) that provides temporary access. This segmentation allows multiple users to access the account without sharing the same persistent credentials, thereby maintaining security while enabling access sharing. Each user receives a unique dynamic credential that expires after use or after a specified time period.
Solution Approach 2:
The patent introduces an intermediary authentication service that acts as a mediator between the account holder and multiple users. This service manages the distribution of dynamic credentials, tracks which user is accessing the account at any given time, and automatically revokes access when appropriate. The intermediary maintains the static credential securely while generating and distributing temporary access tokens to authorized users, eliminating the need for direct credential sharing between users.
2Ease of operation
If credentials are shared among multiple users, then access is provided to multiple users, but tracking which user is accessing the account becomes difficult
Solution Approach 1:
The patent implements a feedback mechanism through the intermediary authentication service that tracks and records which user is accessing the account at any given time. When a user presents a dynamic credential for authentication, the service logs the access event, associates it with the specific user, and maintains this information for audit purposes. This feedback loop provides real-time visibility into account usage without interfering with the access sharing functionality.
Solution Approach 2:
The patent creates a copy of the authentication information in the intermediary service's records. Instead of relying on the static credential alone to identify the user, the system generates and stores a mapping between the dynamic credential and the user's identity in the intermediary service. This copied information allows the system to track which user is accessing the account while the actual credential remains secure and unchanged.
3Reliability
If credentials are revoked manually, then access can be restricted, but the process is inefficient and time-consuming
Solution Approach 1:
The patent implements preliminary action by setting expiration times and conditions for dynamic credentials in advance. When a credential is issued to a user, it is automatically configured to expire after a specified time period or after a single use. This preliminary configuration eliminates the need for manual revocation in many cases, as the credential becomes invalid automatically according to pre-set parameters. The system proactively manages credential lifecycle without requiring ongoing manual intervention.
Solution Approach 2:
The patent enables self-service through automated credential management. The intermediary authentication service automatically generates, distributes, expires, and revokes credentials based on pre-configured policies and conditions. When revocation is needed, the system can automatically invalidate dynamic credentials through automated processes, such as detecting suspicious activity patterns or simply enforcing time-based expiration. This self-service approach eliminates manual credential revocation entirely, saving time and reducing human error.
Data Source
AI summary
An apparatus in one embodiment comprises at least one processing device that includes a processor coupled to a memory, with the at least one processing device being configured to provide an authentication service for sharing access credentials of a protected resource among multiple users. The at least one processing device in providing the authentication service for sharing the access credentials is further configured to obtain the access credentials at least in part from a first one of the users, to automatically provide the access credentials to at least one additional one of the users responsive to authentication of the at least one additional user and satisfaction of one or more specified distribution conditions, and to automatically modify the access credentials responsive to satisfaction of one or more specified revocation conditions. The protected resource may comprise, for example, a user account of a website.