Delegated Authentication Mechanism for Untrusted Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing authentication processes on computing devices require users to manually provide credentials for each application, making the process cumbersome and inefficient, and often necessitate the installation of a gatekeeping application, which may not be desirable for users.
Innovation Solution
A delegated authentication mechanism where an untrusted application relies on a previously authenticated trusted application within the same environment for authentication, eliminating the need for users to provide credentials or maintain lists of trusted applications, by using a unique parameter correlated with the client device's credentials to authenticate with an identity server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a gatekeeping application is installed to handle authentication, then authentication can be automated and users don't need to manually provide credentials, but the device complexity increases and users must install and maintain additional applications
Solution Approach 1:
The operating system's credential storage mechanism serves itself by automatically providing credentials to applications through the credential interface, eliminating the need for a separate gatekeeping application. The system self-manages authentication by having applications directly query the credential store using the standardized interface.
Solution Approach 2:
The credential interface is designed as a universal mechanism that serves multiple applications simultaneously. Instead of requiring separate gatekeeping applications for each app, the standardized credential interface provides authentication services to any application that implements the interface, making the system multi-functional and reducing overall complexity.
2Device complexity
If users manually provide credentials for each application, then device complexity remains low and no additional applications are needed, but the authentication process becomes cumbersome and time-consuming
Solution Approach 1:
User credentials are stored in advance in the operating system's credential store during initial device setup or previous authentication events. When an application needs authentication, the credentials are already prepared and can be retrieved immediately through the credential interface, eliminating the need for users to manually input them each time.
Solution Approach 2:
The credential interface acts as an intermediary layer between the credential store and applications. It automates the retrieval and provision of credentials, replacing manual user input with an automated mediation process that quickly provides authentication information to applications without user intervention.
3Adaptability or versatility
If a gatekeeping application is used for authentication, then users don't need to maintain credentials for each application, but users must install and maintain that specific gatekeeping application on the device
Solution Approach 1:
The operating system's credential store automatically manages credentials for all applications without requiring users to install or maintain separate gatekeeping applications. The system self-provides authentication services through the standardized credential interface that is built into the operating system architecture.
Solution Approach 2:
The credential interface provides universal authentication support across all applications without requiring application-specific gatekeepers. Any application that implements the credential interface can access authentication services, making the system versatile without imposing additional installation requirements on users.
Data Source
AI summary
Disclosed is a system for delegating authentication of an untrusted application executing on a client device. For delegated authentication, an untrusted application relies on a trusted application executing in the same environment for authentication purposes. The delegated authentication process avoids requiring the user of the untrusted application to provide authentication credentials. The disclosed system for delegating authentication enables any trusted application executing in the same computing environment to authenticate the untrusted application.