Continuous Authentication for Single Sign-On Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional digital security systems face limitations in providing secure single sign-on access to multiple computing services, as they often rely on access tokens or pre-stored credentials, leading to single points of failure and inadequate authentication controls, which can result in unauthorized access and data breaches.
Innovation Solution
A security system employing continuous multi-factor authentication (CMFA) between an authentication server and user devices, establishing a secure communication channel and continuously authenticating users, eliminating the need for access tokens and pre-stored credentials, ensuring secure access across multiple services without re-authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional SSO procedures use access tokens to grant user access to multiple services, then ease of operation is improved, but security is worsened due to single point of failure and loss of user control
Solution Approach 1:
The patent extracts the authentication verification process from the initial login moment and distributes it continuously across multiple service access points. Instead of relying on a single access token issuance, the system continuously verifies authentication status at each service boundary, removing the single point of failure inherent in token-based SSO.
Solution Approach 2:
The system implements continuous feedback loops where authentication status is repeatedly verified between the user device and each service. The authentication server provides ongoing feedback about credential validity, and services report access attempts back to the authentication server for real-time verification, creating a dynamic security monitoring system.
2Reliability
If users maintain multiple credentials for different computing services, then security is improved through credential diversity, but ease of operation is worsened due to difficulty in remembering credentials
Solution Approach 1:
The patent creates a universal authentication mechanism where a single set of credentials stored on the user device can authenticate across multiple different services. The authentication server acts as a multi-functional intermediary that validates the same credentials against multiple service providers, eliminating the need for users to manage separate credentials for each service while maintaining security through centralized verification.
3Ease of operation
If conventional password managers use a master password to protect all credentials, then ease of operation is improved, but security is worsened due to single point of failure
Solution Approach 1:
The patent extracts the authentication verification function from the master password storage model and relocates it to continuous service-level verification. Instead of relying on a single master password that protects all credentials centrally, the system extracts verification responsibilities and distributes them to individual service access points, eliminating the single point of failure.
Solution Approach 2:
The authentication security model is segmented from a centralized master password protection approach into distributed service-level verification. Each service access point independently verifies credentials through the authentication server, breaking the monolithic security model into separate, independent verification instances that cannot all fail simultaneously.
4Productivity
If access tokens are used for SSO, then productivity is improved by eliminating re-authentication, but security is worsened due to unauthorized access risks and data breaches
Solution Approach 1:
The patent implements continuous authentication verification that persists throughout the user's access session. Rather than a one-time token issuance, the system maintains continuous verification of credential validity at each service access point, ensuring that authentication remains active and verified throughout the entire usage period without interruption or token expiration.
Solution Approach 2:
The system establishes continuous feedback mechanisms where the authentication server monitors and verifies credential validity in real-time across all service accesses. Unauthorized access attempts trigger immediate feedback loops that alert the authentication server, which can then invalidate credentials or alert users, providing ongoing security monitoring rather than static token-based access.
Data Source
AI summary
Systems and methods for continuous secure single sign on for secure access services. A user device stores a first authentication factor associated with a user for authorizing access. An authentication server receives an authentication request by the user to a secure access service and establishes a secure communication channel between the authentication server and the user device. The user device performs a user authentication according to a second authentication factor, generates an authentication response indicating the first authentication factor and confirming the authentication, the authentication response and transmits the response to the authentication server via the secure communication channel. The authentication server grants access to the secure access service based on the authentication response, repeatedly determines whether the secure communication channel is maintained while the user accesses the secure access service, and permits access to the secure access service by the user while the secure communication channel is maintained.