Credential Service Mediator for Secure Session Renegotiation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face security risks when entering credentials on untrusted or compromised computers, as malicious programs can steal these credentials, compromising the security of web resources and services.
Innovation Solution
A credential service is used to receive user credentials from a computing device, establish a secure session with an identity provider, and then renegotiate or resume this session to communicate the credentials securely, ensuring the computing device remains unaware of the credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user credentials are entered directly on the computing device, then ease of operation is improved, but security is worsened due to exposure to malicious programs
Solution Approach 1:
The patent introduces a credential service as an intermediary component that mediates between the computing device and the identity provider. The credential service receives credentials from the computing device, establishes a secure session with the identity provider, and transmits credentials through this secure channel. This intermediary architecture allows the computing device to operate conveniently while preventing direct exposure of credentials to malicious programs on the device.
2Object-affected harmful factors
If a secure session is established between the computing device and identity provider, then security is improved, but device complexity increases due to session management requirements
Solution Approach 1:
The patent extracts the secure session management functionality from the computing device and relocates it to the credential service. The credential service is responsible for establishing, maintaining, and managing secure sessions with identity providers, while the computing device simply communicates credential requests and responses. This extraction reduces the complexity burden on the computing device while maintaining security through centralized session management.
3Object-affected harmful factors
If credentials are transmitted through a secure session, then security is improved, but loss of time increases due to session establishment overhead
Solution Approach 1:
The patent implements preliminary action by having the credential service establish secure sessions with identity providers in advance, before actual credential transmission is needed. The session management and security context are prepared beforehand, allowing credentials to be transmitted quickly when requested by the computing device. This preliminary setup reduces the time penalty associated with secure credential transmission.
Data Source
AI summary
Protecting user credentials from a computing device includes establishing a secure session between a computing device and an identity provider (e.g., a Web service). Parameters of the secure session are communicated to a credential service, which renegotiates or resumes the secure session to establish a new secure session between the credential service and the identity provider. User credentials are passed from the credential service to the identity provider via the new secure session, but the computing device does not have the parameters of the new secure session and thus does not have access to the passed user credentials. The credential service then renegotiates or resumes the secure session again to establish an additional secure session between the credential service and the identity provider. Parameters of the additional secure session are communicated to the computing device to allow the computing device to continue communicating securely with the identity provider.