Authentication Token Validation for Web Application Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single sign-on (SSO) systems rely on the availability of an identity provider (IdP) for user authentication, leading to inconvenience and potential monetary losses when the IdP is unavailable.
Innovation Solution
A method and system that retrieves an authentication token from an external trusted source, allowing users to access web applications without relying on the availability of the identity provider, using a processor to validate user identifiers and biometric data, and forwarding the authentication token to relying party applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If single sign-on (SSO) is performed using an identity provider (IdP), then user authentication is simplified and security is enhanced, but access to web applications is blocked when the IdP is unavailable
Solution Approach 1:
The patent introduces a relying party application as an intermediary that can perform local authentication validation. Instead of requiring all authentication requests to pass through the central IdP, the relying party application can validate authentication tokens locally, serving as a mediator between the user and the authentication system. This resolves the contradiction by maintaining authentication availability through local validation capabilities while preserving the security benefits of centralized authentication.
Solution Approach 2:
The patent implements preliminary authentication where users authenticate in advance and receive authentication tokens that can be validated locally by relying party applications. This preliminary action stores authentication credentials locally, enabling access continuity even when the IdP is unavailable. The authentication is performed beforehand, and the resulting tokens enable subsequent access without requiring real-time IdP connectivity.
2Reliability
If authentication tokens are always retrieved from an external trusted source, then authentication security is maintained, but system complexity increases and access is blocked when the external source is unavailable
Solution Approach 1:
The patent segments the authentication system into two independent parts: (1) the external trusted source that issues authentication tokens, and (2) the relying party application that validates tokens locally. This segmentation allows the system to maintain security through external authentication while reducing complexity and improving availability through local validation capabilities. Each component can operate semi-independently, resolving the contradiction between security and complexity.
Solution Approach 2:
The patent implements local quality by enabling the relying party application to perform authentication validation locally rather than requiring all operations to connect to the external trusted source. Different parts of the system have different functions: the external source issues tokens while the local application validates them. This local validation capability reduces system complexity and improves availability while maintaining the security benefits of external authentication.
3Reliability
If multiple passwords are required for accessing different web applications, then security is improved, but user usability deteriorates due to the need to recall multiple credentials
Solution Approach 1:
The patent implements universality by creating a single authentication token that can be used across multiple relying party applications. Instead of requiring separate passwords for each application, the same authentication mechanism and token format can validate access to multiple different web applications. This multi-functional authentication approach maintains security while dramatically improving usability, as users only need to manage one set of credentials.
Data Source
AI summary
A method, a system, and a non-transitory computer readable program code are disclosed for authentication of users for access to web applications. The method includes receiving, by a processor, a user identifier and a biometric identifier for a user with a request to access one or more relying party applications; validating, by the processor, the user identifier and the biometric identifier for the user with the request to access the one or more relying party applications; retrieving, by the processor, an authentication token for the user from an external trusted source; forwarding, by the processor, the authentication token for the user retrieved from the external trusted source to the one or more relying party applications; and receiving, on the processor, authentication from the one or more relying party applications for the user to access the one or relying party applications.