Credential Store Public Key Encryption SSO
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Single Sign-On (SSO) systems fail to provide comprehensive enterprise-wide security coverage, especially when dealing with different vendor systems, and often compromise security by relying on single points of attack or insecure password transmission.
Innovation Solution
A secure credential store system that uses public key encryption to encrypt and decrypt credentials on a credential server, allowing secure access to computer systems while preventing single points of attack and minimizing exposure of passwords, utilizing a credential store with a processor, keychains, and resource chains, and integrating with external authentication systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are encoded using simple encodings like Base64 and passed to different systems, then ease of operation is improved, but security deteriorates due to single points of attack and insecure password transmission
Solution Approach 1:
The patent divides the credential storage and management into separate segments: each credential is encrypted with a unique public key corresponding to a specific user, and credentials are stored in a distributed credential store rather than a single centralized location. This segmentation eliminates the single point of attack while maintaining ease of access through the keychain mechanism.
Solution Approach 2:
The patent introduces a credential server as an intermediary between users and the credential store. The server handles the complex encryption and decryption operations transparently, allowing users to access credentials without managing cryptographic keys directly. This intermediary simplifies operation while maintaining security through proper cryptographic protocols.
2Device complexity
If all passwords are encrypted using a single key in a single place, then ease of manufacture and system simplicity are improved, but security deteriorates due to attractive single points of attack
Solution Approach 1:
The patent segments the encryption keys so that each credential is encrypted with a unique public key corresponding to a specific user. This eliminates the single point of attack while maintaining manageable complexity through automated key management handled by the credential server.
Solution Approach 2:
The patent transitions from a single-point encryption model to a distributed multi-dimensional encryption model where credentials are spread across multiple locations and encrypted with different keys. This dimensional expansion of the security architecture eliminates vulnerability to single-point attacks while the credential server maintains operational simplicity.
3Adaptability or versatility
If a centralized credential store is used for enterprise-wide SSO, then adaptability and coverage are improved, but security deteriorates due to single points of failure and attack
Solution Approach 1:
The patent segments the centralized credential store into a distributed architecture where credentials are stored in multiple locations with unique encryption keys. This maintains enterprise-wide coverage and adaptability while eliminating the single point of failure and attack that plagues centralized systems.
Solution Approach 2:
The credential server acts as an intermediary that provides unified access to the distributed credential store, maintaining enterprise-wide SSO capability. The server handles the complexity of accessing distributed credentials with different encryption schemes, providing adaptability across various systems while the distributed storage ensures security through elimination of single points of attack.
Data Source
AI summary
A credential store provides for secure storage of credentials. A credential stored in the credential store is encrypted with the public key of a user owning the credential. A first user may provide a credential owned by the first user to a second user. The first user may add credentials owned by the first user to the credential store. An administrator may manage users of the credential store without having the ability to provide credentials to those users.