Credential Management System for Secure SSO Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in allowing individual users access to remote servers while keeping credentials and session information secure, and in implementing single sign-on (SSO) across multiple remote servers without disclosing credentials or session data to client devices.
Innovation Solution
A computer-implemented method and system that provides credentialed access to remote servers by transmitting and managing credentials and session secrets, with restricted access to client devices, using encryption, proxy servers, and selective routing, allowing for SSO across multiple servers without exposing credentials or session data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If credentials and session information are disclosed to client devices for access authentication, then access control functionality is achieved, but security is compromised as users can access or misuse credentials
Solution Approach 1:
The patent introduces a credential management system that acts as an intermediary between users and remote servers. This system stores credentials securely on a server, transmits them during authentication, and then restricts client device access to the credentials while maintaining session functionality. The intermediary manages the credential lifecycle without exposing sensitive data to end users.
Solution Approach 2:
The patent segments the credential management process into distinct components: credential storage, credential transmission, session management, and client device operation. By separating these functions, the system can securely manage credentials on the server side while allowing clients to interact with session data without accessing underlying credentials.
2Adaptability or versatility
If individual user access to remote servers is enabled with unique credentials, then personalized access control is achieved, but credential management complexity increases significantly
Solution Approach 1:
The patent creates a universal credential management system that handles multiple users, multiple remote servers, and various authentication scenarios through a single centralized platform. This system provides multi-functionality by supporting individual user credentials, organizational credentials, session management, and restricted client access all through one system, eliminating the need for separate credential management for each user-server pair.
3Ease of operation
If session information is made accessible to client devices for subsequent access, then convenience of repeated access is improved, but security risks increase as session data may be exposed or misused
Solution Approach 1:
The system uses the credential management system as an intermediary that controls session information flow. The intermediary transmits necessary session data to clients for convenient access while simultaneously filtering and restricting what session information reaches the client device, preventing exposure of sensitive session secrets while maintaining functional access.
Data Source
AI summary
Credentials for an account on a remote server requiring credentialed access by a client device are created, credentials are transmitted to the remote server, and response data including the credentials is received from the remote server, while restricting access to the credentials by the client device at all times. Session data transmitted by the remote server is also restricted from the client device to prevent side loading of session secrets onto client devices that may be used to attempt to gain unauthorized access to the remote server. Cookies are used to allow the client device to access more than one remote server without having to authenticate individually to each remote server.