Delegated Authentication for Non-Web Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication protocols struggle to securely authenticate non-web-based applications, as they cannot utilize HTTP protocols for redirects or set cookies, leading to potential unauthorized access and lack of single-sign-on experiences.
Innovation Solution
A system for secure delegated authentication that assigns a unique identifier to third-party applications, allowing secure routing of responses from service providers, enabling authentication without relying on web-based features and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If web-based authentication protocols are used, then authentication functionality is provided, but non-web-based applications cannot securely receive authorization responses
Solution Approach 1:
The patent introduces an intermediary component (the authentication system server) that mediates between web-based authentication protocols and non-web applications. The server receives web-based authentication responses, validates them, and securely transmits authorization information to non-web applications through alternative channels, thus enabling protocol compatibility without requiring the applications themselves to be web-based.
2Reliability
If application identifiers are not verified, then authentication processing is simplified, but unauthorized applications can access user data
Solution Approach 1:
The patent implements preliminary verification of application identifiers during the authentication flow. Before authorizing any access, the system checks whether the identifier in the authentication response matches the expected identifier for the application. This preliminary security check prevents unauthorized applications from accessing user data while maintaining a straightforward verification process that doesn't significantly increase system complexity.
3Reliability
If authentication responses are not securely routed, then response delivery is simplified, but unauthorized access to user data occurs
Solution Approach 1:
The authentication system server acts as an intermediary that securely routes authentication responses to the correct applications. It maintains a mapping between authentication responses and target applications, verifying identifiers to ensure responses are delivered only to authorized applications. This intermediary routing mechanism ensures security while keeping the delivery process manageable through centralized coordination.
Data Source
AI summary
A system for secure delegated authentication for applications may include one or more processors and a memory. The one or more processors perform operations including receiving a request from an application to retrieve a user authorization associated with a service provider. The operations also include authenticating the application in response to the request, the application being assigned a first identifier to associate the request with the application. The operations also include communicating the request to the service provider upon the application being authenticated. The operations also include receiving a response from the service provider, the response identifying a particular application associated with the service provider. The operations also include comparing the first identifier with at least a portion of the response to determine a match. The operations further include forwarding the received response to the application if a match is determined.