Cross-Browser SSO via Local Device Agent
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In corporate environments, single sign-on (SSO) for web-based applications is challenging due to the inability to reliably share user sessions across different web browsers, requiring users to authenticate each time they log in, especially when specific browser versions are required, and existing solutions pose security risks or require additional software installations.
Innovation Solution
A computing device with a local web server running on the same device as the web browser, which communicates with an authentication server to manage user authentication tokens, allowing seamless SSO without exposing session identifiers and without the need for browser modifications or additional software installations, using JSON Web Tokens and secure communication channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a user session is shared between multiple web browsers, then single sign-on can be achieved, but security risks increase due to exposure of session identifiers
Solution Approach 1:
The patent introduces a backend service as an intermediary between the web browser and authentication server. This service receives authentication requests from the browser, communicates with the authentication server, and manages session state locally. The backend service acts as a mediator that enables SSO functionality without requiring the browser to directly handle sensitive session identifiers, thus resolving the contradiction between ease of operation and security.
2Object-affected harmful factors
If authentication is required in each web browser, then security is maintained, but user convenience deteriorates due to repeated authentication
Solution Approach 1:
The patent segments the authentication system into multiple components: the web browser for user interaction, a backend service for session management, and the authentication server for credential verification. By dividing the authentication process across these segments, the system can maintain security at the server level while providing convenience at the browser level through local session state management in the backend service.
3Reliability
If specific web browser versions are required, then application compatibility is ensured, but adaptability decreases across different browsers
Solution Approach 1:
The backend service serves as an intermediary layer between the web application and various web browsers. It handles browser-specific variations and protocols, translating them into a unified authentication interface. This allows the application to maintain reliable authentication logic while adapting to different browser versions and types through the mediation of the backend service.
4Ease of operation
If federation is used for single sign-on, then cross-application authentication is enabled, but setup complexity increases for corporations
Solution Approach 1:
The patent implements a feedback mechanism where the backend service monitors authentication requests and responses, learning from the interaction patterns between users, browsers, and authentication servers. This feedback loop enables the system to automatically adapt to different authentication scenarios and reduce setup complexity by dynamically configuring authentication flows based on observed usage patterns.
Data Source
AI summary
A system for providing single sign-on comprises an authentication server, multiple application servers and multiple computing devices. An application server directs a web browser running on a computing device to the authentication server. If the authentication server cannot authenticate the user based on the request it receives, it causes the browser to contact a web server of a local device agent also running on the computing device. The device agent determines whether a token for authenticating the user is available and if so, transmits a response which includes the token. If the authentication server can authenticate the user based on the token, it transmits a response which includes authentication information associated with the token and which causes the browser to direct to the application server. This reduces the number of times the user must authenticate himself without compromising security or requiring adapted web browsers.