Authentication Session Transfer via Encoded Download Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The current process of signing in to applications across multiple devices is disjointed, leading to inefficiencies and security issues, particularly when transferring authentication sessions between devices, as existing solutions often require manual credential entry and can compromise user identity information.
Innovation Solution
A method that uses an identity service to generate URLs encoding authentication and application download objects, allowing seamless authentication and application installation on mobile devices by transferring existing authenticated sessions without manual credential entry, ensuring secure zero-trust authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If manual credential entry is required for mobile application sign in, then authentication security is maintained, but user convenience and login efficiency deteriorate
Solution Approach 1:
The system performs preliminary authentication on a trusted first device before the user accesses the mobile application. The authentication credentials are validated in advance, and the authenticated session state is transferred to the mobile device, eliminating the need for manual credential entry while maintaining security through pre-validated authentication
Solution Approach 2:
The system introduces an intermediary authentication session transfer mechanism that mediates between the first device and the mobile application. Instead of direct manual credential entry, the authenticated session is transferred through a controlled intermediary process that validates and propagates authentication state across devices without exposing credentials
2Ease of operation
If QR code scanning is used for authentication, then manual credential entry is eliminated, but the process becomes disjointed and user experience is not optimized
Solution Approach 1:
The system merges the authentication and application launch processes into a single unified flow. Instead of separate QR code scanning and manual authentication steps, the authenticated session transfer is integrated directly into the application launch sequence, creating a seamless single-step process that reduces operational complexity
Solution Approach 2:
The system performs preliminary authentication and session preparation before the user initiates the mobile application launch. The authentication state is pre-established and ready for transfer, so when the user launches the application, the session transfer occurs automatically in the background without requiring separate authentication actions
3Ease of operation
If authentication artifacts are provided to third parties for SMS-based authentication, then authentication capability is enabled, but user identity information security is compromised
Solution Approach 1:
The system extracts and removes the vulnerable element of transmitting authentication artifacts through third-party SMS channels. Instead of relying on SMS-based authentication that requires sharing credentials with third parties, the system uses direct device-to-device session transfer that eliminates the need for intermediary SMS services, thereby removing the security vulnerability while preserving authentication capability
4Ease of manufacture
If application download and authentication are separate steps, then each process can be optimized independently, but overall process efficiency and user experience deteriorate
Solution Approach 1:
The system merges the application download and authentication processes into a single integrated operation. The authenticated session transfer is combined with the application launch sequence, so that authentication occurs as part of the download/launch flow rather than as a separate subsequent step, thereby improving overall process efficiency while maintaining the ability to optimize each component
Data Source
AI summary
Methods for authentication session transfer using application download links are performed by systems and devices. A user or administrator at a first device enables the user to use an application at the user's mobile device. The user or administrator provides a request for the mobile application from the first device to an identity service. The identity service generates a uniform resource locator (URL) that encodes an authentication object generated by the identity service that is specific to the user's identity, and provides the URL to the mobile device. The identity service receives the authentication object back from a browser session of the URL at the user device, and establishes an authenticated browser session of the URL using the authentication object. The identity services authenticates the user's identity for the mobile application responsive to the mobile application invoking the authenticated browser session at the user device.