Decentralized SSO Credential Management via Local Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges in securely managing multiple online account passwords due to complexity, vulnerability to interception, and the risks associated with centralized password storage, which can lead to compromised sensitive information if hacked.
Innovation Solution
A decentralized credential management system using single sign-on with local encryption and decryption, employing multi-layered security approaches, including hashing, one-time random numbers, and distributed storage across public or private clouds, ensuring secure and convenient access to multiple accounts without centralizing sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users employ complex passwords to enhance security, then security is improved, but user convenience deteriorates as users struggle to remember multiple complex passwords
Solution Approach 1:
The system segments password management by introducing a master password that controls multiple account credentials. Instead of users managing numerous individual passwords, the credential management system divides the burden into: (1) a single master password held by the user, and (2) encrypted credential data stored securely, allowing users to access multiple accounts without remembering each password.
Solution Approach 2:
The patent introduces a credential management system as an intermediary between the user and multiple online accounts. This intermediary system handles password encryption, storage, and retrieval automatically. The user interacts only with the master password while the intermediary manages all other credentials, eliminating the need for users to directly handle multiple complex passwords.
2Ease of operation
If users write down passwords to remember them, then ease of operation is improved, but security deteriorates as passwords become vulnerable to unauthorized access
Solution Approach 1:
The system replaces the mechanical approach of writing passwords on paper with a cryptographic system. Instead of physical storage that can be seen by others, passwords are transformed into encrypted digital data stored in a secure credential management system accessible only through the master password and security questions.
Solution Approach 2:
The patent changes the state of password storage from plain text (written or digital) to encrypted form. By applying cryptographic transformations, the system maintains password accessibility through authorized channels while making unauthorized access computationally infeasible, even if the storage medium is compromised.
3Ease of operation
If passwords are transmitted in clear text for convenience, then ease of operation is improved, but security deteriorates due to interception risks over networks
Solution Approach 1:
The system performs preliminary encryption of credentials before they leave the user's device. Passwords and security questions are encrypted locally using cryptographic algorithms before transmission to the credential management system. This preliminary security measure ensures that even if network transmission occurs, the data remains protected and cannot be intercepted in usable form.
4Ease of operation
If centralized password storage is used to simplify management, then ease of operation is improved, but security deteriorates as a single point of failure compromises all accounts
Solution Approach 1:
The credential management system segments sensitive information by storing encrypted credentials rather than plain text passwords. The encryption keys are derived from user-specific inputs (master password and security questions) rather than being centrally stored. This segmentation ensures that even if the central database is compromised, attackers cannot directly access usable credentials without the encryption keys.
Solution Approach 2:
The system fundamentally changes the storage parameter from plain text to encrypted format. By applying cryptographic transformations to all stored credentials, the system maintains centralized management benefits while eliminating the security vulnerability of storing readable passwords. The encrypted form ensures that compromised storage does not directly lead to compromised accounts.
Data Source
AI summary
A method for single sign-on (SSO) that provides decentralized credential management using end-to-end security. Credential (and other personal user information) management is decentralized in that encryption is performed locally on the user's computer. The user's encrypted credentials may be stored by the login server and/or a plurality of distributed servers/databases (such as a cloud). The login server never has access to the user's credentials or other personal information. When the user wants to use single sign-on, he enters his password into his browser and the browser submits the encrypted/hashed password to the login server for validation. Upon validation, the browser receives the user's encrypted credentials. The credentials are decrypted by the browser and provided to relevant websites to automatically log the user in.