Browser Helper Object Single Sign-On Security Token
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed computing environments, users face inefficiencies due to the frequent need to log in and out of multiple applications, requiring repeated input of mainframe user IDs and passwords, which is cumbersome and time-consuming, especially when switching between applications that access data stored in a mainframe system.
Innovation Solution
An automated single sign-on system using a browser helper object (BHO) that generates and manages a security token, allowing seamless transitions between applications without re-entering credentials, by correlating local login information with mainframe access rights through an authentication server and middleware, and encrypting the token for security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If users log in to multiple applications separately, then each application can maintain secure access control, but users must repeatedly enter credentials which is time-consuming and inefficient
Solution Approach 1:
The system performs preliminary authentication with the mainframe at the browser level before application access is needed. The browser helper object establishes a security token containing mainframe user ID and password credentials in advance, so that when applications need access, the credentials are already prepared and can be automatically provided without requiring users to re-enter them.
Solution Approach 2:
The patent introduces a browser helper object as an intermediary component that sits between the user's browser and the applications. This intermediary manages the security token, correlates local login information with mainframe access rights, and automatically provides credentials to applications, eliminating the need for users to manually enter credentials for each application.
2Ease of operation
If the system stores mainframe credentials locally, then automatic sign-on is enabled, but security risks increase
Solution Approach 1:
Instead of storing actual mainframe credentials locally, the system creates a copy or representation of the authentication state through a security token. This token contains correlated information about the user's authentication status and can be used to automatically provide credentials to applications without requiring the system to store the actual mainframe user ID and password in a vulnerable form.
Solution Approach 2:
The browser helper object acts as a secure intermediary that manages credential storage and transmission. It correlates local login information with mainframe access rights through an authentication server, ensuring that credentials are not stored in plain text but are instead managed through a secure token-based system that maintains security while enabling automatic sign-on.
3Productivity
If the system implements single sign-on, then login procedures are reduced, but system complexity increases
Solution Approach 1:
The browser help object is designed as a universal component that can work across multiple different applications. Instead of implementing separate single sign-on mechanisms for each application, the BHO provides a unified approach that correlates local login information with mainframe access rights for any application that needs to access the mainframe, reducing overall system complexity while maintaining high access efficiency.
Data Source
AI summary
A system and method is provided for a distributed computing system where a user can login to a client computer and access a number of different applications installed on web servers. These applications are then provided access to data in mainframe systems without a user having to enter mainframe user id or password information for gaining access to the mainframe system. The system and method can utilize a sign on object which is installed onto the client computer. The sign on object operates to obtain and transmit a security token which authorizes access to the mainframe system, and the security token does not require the use of the cookie data. This system and method can pass the security token through the web server and the web application in an encrypted form which limits security risks.