Zero-Knowledge Cloud SSO Vault Service Architecture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Single Sign-On (SSO) schemes complicate user access to resources across multiple devices, especially in business settings, due to the requirement of on-premises application services and additional network transactions, which can impact security and increase administrative burdens.
Innovation Solution
A computer-implemented method for facilitating SSO to a digital vault using a vault service provider, where users perform a login process with an identity provider, generating a signed attestation and device identifier to retrieve an encrypted data key, allowing secure access across devices without the need for on-premises software, maintaining a zero-knowledge environment by storing sensitive data encrypted on the user's client device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If on-premises application services are deployed for SSO authentication, then authentication security is improved, but device complexity and administrative burden increase
Solution Approach 1:
The patent extracts the SSO authentication functionality from on-premises application services and relocates it to a cloud-based identity provider. The identity provider handles authentication, attestation verification, and session management remotely, eliminating the need for users to install and maintain local authentication services while preserving security through centralized control and updated protocols.
Solution Approach 2:
The patent introduces a cloud-based identity provider as an intermediary between users and resources. The identity provider mediates authentication by verifying signed attestations from trusted sources, issuing security tokens, and managing session state remotely. This intermediary approach maintains authentication security while removing the complexity of local service deployment.
2Reliability
If additional network transactions are implemented for secure data transmission, then data security is improved, but transmission speed and efficiency decrease
Solution Approach 1:
The patent performs authentication and security token issuance beforehand through the identity provider before actual data transmission occurs. The signed attestation verification and security token establishment create a trusted session in advance, allowing subsequent data exchanges to proceed more efficiently without repeated authentication overhead for each transaction.
3Ease of operation
If cloud-based SSO authentication is used, then ease of access across devices is improved, but authentication security may be compromised
Solution Approach 1:
The cloud-based identity provider acts as a secure intermediary that performs rigorous attestation verification before issuing authentication tokens. The identity provider validates signed attestations from trusted sources, ensuring that cloud-based access maintains strong security controls while enabling convenient cross-device authentication through centralized identity management.
Solution Approach 2:
The system implements feedback mechanisms where the identity provider continuously verifies device attestation status and session validity. The signed attestation process provides feedback on device trustworthiness, and the system can revoke or update authentication tokens based on changing security conditions, maintaining security while enabling cloud-based access.
Data Source
AI summary
Systems and methods for providing secure single sign-on authentication and management of encrypted vault in a fully cloud-based zero-knowledge environment. A user on a client device attempts to use a network resource. The user is directed to login to the identity provider. The identity provider authenticates the user through a login process. If the user is identified to be a valid user, the identity provider sends the user an attestation sign-on key to confirm the user is valid. The client device sends the attestation sign-on key to a vault service provider, which verifies the attestation using a configured public key. The client device retrieves a data decryption key and an encrypted data key, which are stored in different entities in the system. The encrypted data key is decrypted on the client device using the data decryption key.