Client-Side Local Encryption for Single Sign-On
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Single Sign-On (SSO) systems face a security flaw in encrypting client-side application data, as the client-side portion cannot generate an encryption key when login credentials are managed by an external authentication source, making it impractical to securely encrypt and decrypt data.
Innovation Solution
A client-side application generates a random encryption key and encrypts locally-stored data with it, using a key-encrypting key derived from a pseudorandom function to ensure secure encryption and decryption, even when login credentials are managed by a trusted third party.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SSO system is used to manage login credentials externally, then ease of operation and password fatigue reduction is improved, but the ability to generate encryption keys on client-side deteriorates
Solution Approach 1:
The encryption key generation process is segmented into two parts: a random key generated and stored locally on the client device, and a key-encrypting key derived from SSO authentication. This segmentation allows the system to maintain both ease of operation through SSO and reliability through local key generation capability.
Solution Approach 2:
The client-side application generates and stores a random encryption key in advance, before SSO authentication occurs. This preliminary action ensures that the encryption key is already available on the client device, resolving the contradiction by preparing the key generation capability beforehand rather than requiring it during the SSO authentication process.
2Reliability
If encryption key is derived from user password, then encryption security is improved, but practicality deteriorates when credentials are managed by external authentication source
Solution Approach 1:
Instead of deriving the encryption key from the user password (traditional approach), the patent inverts the approach by generating a random encryption key locally and using the SSO-authenticated key-encrypting key to encrypt that random key. This inversion resolves the contradiction by making the encryption key independent of the password while maintaining both security and practicality.
Solution Approach 2:
The patent introduces an intermediary random encryption key that mediates between the SSO system and the encrypted data. The SSO system generates a key-encrypting key that encrypts the random encryption key, which in turn encrypts the application data. This intermediary structure allows the system to maintain encryption security without requiring direct password-based key derivation, thus resolving the contradiction between security and practicality.
3Reliability
If client-side data is encrypted without local key generation, then device security is improved, but data accessibility deteriorates
Solution Approach 1:
The random encryption key is generated and stored locally on the client device in advance, before any encryption operations occur. This preliminary action ensures that the decryption capability remains on the client device, maintaining data accessibility while the SSO-based key-encrypting key provides the security layer.
Solution Approach 2:
The encryption system is segmented into two layers: the data encryption key stored locally on the client device for accessibility, and the key-encrypting key generated by the SSO system for security. This segmentation resolves the contradiction by placing different security and accessibility functions in different locations within the system.
Data Source
AI summary
The present disclosure describes techniques that allow for a client-side application, located on a first client device, to generate a random encryption key and encrypt locally-stored application data with the random encryption key. The random encryption key is used in lieu of a password-derived encryption key. In order to ensure that the client-device application is unable to decrypt the locally-stored encrypted application data prior to authenticating with an external authentication source (i.e., SSO, IdP), the random encryption key is encrypted with a key-encrypting key derived using a pseudorandom function (PRF). By using a PRF, the first device is able to authenticate to the first server and derive a secure key as part of the authentication process. Accordingly, the present disclosure describes techniques for securing data on a client device when credentials are managed by an external authentication system.