Digital Signature Injection for Federated Identity Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face significant effort and security risks due to the need to authenticate separately for multiple accounts across different systems, with existing solutions like identity providers being complex to integrate and costly for third-party systems, and lacking in secure multifactor authentication.
Innovation Solution
A process on client devices intercepts requests to an identity provider system, injecting digital signatures for user authentication, with local components like containers and proxy servers handling communication and signature injection, and a separate security application for interactive authentication on unsupported devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users authenticate separately for each account across different systems, then each system can maintain its own security credentials, but users face significant effort and security risks due to the need to remember and enter credentials for each account
Solution Approach 1:
The patent introduces an identity provider (IdP) system as an intermediary that users authenticate with once, which then issues tokens that third-party systems can verify. This mediator approach allows users to maintain strong credentials in one secure location while enabling easy authentication across multiple systems without exposing the actual credentials to those systems.
Solution Approach 2:
The patent extracts the authentication credentials from the third-party systems and consolidates them in a centralized identity provider. By taking out the credential management function from individual applications and placing it in a dedicated IdP, the system achieves both strong security (credentials are protected in one location) and ease of operation (users authenticate once at the IdP).
2Ease of operation
If users entrust an identity provider system with their credentials for federated identity, then single sign-on and multifactor authentication become possible, but the integration complexity and cost for third-party systems increase
Solution Approach 1:
The identity provider acts as an intermediary that handles all the complex authentication logic, token issuance, and verification. Third-party systems only need to implement simple token verification, reducing their integration complexity while still enabling sophisticated authentication features like SSO and MFA.
Solution Approach 2:
The patent creates a universal authentication system where a single identity provider can serve multiple third-party systems with different authentication requirements. The IdP handles various authentication methods (passwords, MFA, biometrics) and issues standardized tokens that work across all participating systems, reducing integration complexity for each individual system.
Data Source
AI summary
A process running on client devices intercepts requests destined for an identity provider (“IdP”) system and injects a digital signature corresponding to a user associated with the request. In order to reduce or eliminate the burden on providers of the applications or other resources used by the users, the organization providing the IdP system may also provide components that run locally on the client devices of users and integrate with the users' applications. For example, in one embodiment code of the IdP system is run within a container of an application to handle communication with the IdP system. Additionally, code of the IdP system is run as a local process that handles request interception and digital signature injection. For client devices not supporting the use of the local process, a separate verifier application of the IdP can be run locally and allow interactively performing authentication via a user interface.