Bootstrap Server for SSO Context in Remote Browsing Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Remote browser isolation (RBI) disrupts the single sign-on (SSO) experience and prevents the implementation of multi-factor authentication (MFA) due to the lack of SSO token context and local device hardware authentication in remote browsers.
Innovation Solution
Introduce a bootstrap server to bootstrap SSO context to remote browsing sessions by establishing trusted relationships with both the remote browsing system and identity provider, providing session tokens to client browsers for secure remote browsing sessions, and managing re-authentication events to maintain seamless SSO experiences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If remote browser isolation is implemented to secure remote browsing, then security is improved, but single sign-on experience is disrupted and multi-factor authentication cannot be implemented
Solution Approach 1:
The patent introduces a bootstrap server as an intermediary component that bridges the client browser and the remote browsing system. This bootstrap server receives SSO tokens from the identity provider, validates them, and establishes secure browsing sessions without requiring the remote browser to directly handle authentication. This mediator approach allows SSO to function seamlessly while maintaining the security benefits of remote browser isolation, as the bootstrap server acts as a trusted intermediary that translates between the SSO protocol and the remote browsing protocol.
2Object-affected harmful factors
If remote browser isolation is implemented, then attack surface is reduced, but SSO token context is lost in remote browsers
Solution Approach 1:
The patent implements preliminary action by having the bootstrap server validate SSO tokens and establish session contexts before the remote browsing session begins. The bootstrap server pre-processes authentication information, validates SSO tokens, and sets up the necessary session state in advance. This preliminary authentication and context establishment ensures that when the remote browsing session starts, the SSO token context is already prepared and available, eliminating the need for the isolated remote browser to handle authentication directly while maintaining security.
3Reliability
If remote browser isolation is implemented, then resource protection is improved, but re-authentication events disrupt browsing continuity
Solution Approach 1:
The patent implements feedback mechanisms where the bootstrap server continuously monitors session validity and SSO token status throughout the browsing session. When re-authentication is required, the system provides feedback to the client browser through the bootstrap server, which can present re-authentication requests in a way that maintains session continuity. The bootstrap server manages session state and can refresh tokens or extend sessions based on feedback from the remote browsing system, ensuring that resource protection is maintained while minimizing disruptions to browsing continuity.
Data Source
AI summary
An architecture has been designed that introduces a “bootstrap server” into the single sign-on flow to bootstrap a SSO context to a remote browsing session. The bootstrap server provides a session token to a client browser to establish and secure a session between the client browser and a remote browsing system. After the client browser obtains a SSO token and is redirected to the bootstrap server, the bootstrap server provides a session token for a remote browsing session. The bootstrap server also generates a response to the client browser to cause the client browser to connect to the remote browsing system to establish a remote browsing session with the session token provided by the bootstrap server. With the remote browsing session, the client browser conveys the SSO token for use by the remote browser.