Cross-Device Single Sign-On via Token Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face inefficiencies and increased time when authenticating across multiple client devices in a distributed resource environment, particularly when using multi-factor authentication, as they must repeat the authentication process on each device, leading to reduced productivity and user experience.
Innovation Solution
A computer system and method that enables single sign-on across multiple client devices by using a remote computing device to authenticate a user once and distribute an access token, allowing subsequent devices to authenticate quickly through a single sign-on request, reducing the need for repeated authentication processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multi-factor authentication process is used to ensure security, then authentication reliability is improved, but authentication time and user effort increase
Solution Approach 1:
The system performs preliminary authentication on the first device and stores the access token and session identifier in the remote computing device. When a second device requests access, the system already has the authentication data stored, allowing it to skip the full multi-factor authentication process and only verify the session identifier, thus reducing authentication time while maintaining security.
Solution Approach 2:
The access token acts as an intermediary that carries authentication information between devices. Instead of requiring re-authentication on each device, the access token serves as a mediator that proves the user's identity and authorization status, enabling fast cross-device access without repeating the full authentication process.
2Reliability
If complete authentication process is repeated on each device, then security is maintained, but user productivity decreases
Solution Approach 1:
The authentication process is segmented into two parts: (1) full multi-factor authentication on the first device where the user provides credentials and biometric data, and (2) session verification on subsequent devices where only the session identifier is checked. This segmentation allows security to be established once while enabling rapid access on other devices.
Solution Approach 2:
The system creates a copy of the access token and session identifier that can be shared across multiple devices. This copy contains the essential authentication information needed to verify user identity without requiring the user to re-enter credentials or provide biometric data on each device, thus maintaining security while improving productivity.
3Productivity
If single sign-on is implemented across devices, then authentication efficiency is improved, but system complexity increases
Solution Approach 1:
The remote computing device serves multiple functions: it authenticates users on the first device, stores access tokens, manages session identifiers, and verifies authentication on subsequent devices. By consolidating these functions in a single centralized system, the patent reduces the complexity that would otherwise be distributed across multiple independent authentication systems.
Data Source
AI summary
Systems and methods for providing a single sign-on for authenticating a user via multiple client devices is provided. For example, the system includes a processor configured to receive a first connection request from a first client device. The processor processes the first connection request and transmits an access token to the first client. The processor can further receive a second connection request from a second client device and process the second connection request. The processor can transmit a single sign-on response to the second client device in reply to the second connection request. The second client device can be configured to communicated with and transmit the single-sign on response to the first client device for processing. The processor can receive a single sign-on verification from the first client device, process the single sign-on verification, and transmit a copy of the access token to the second client device.