Distributed Session Manager for Single Sign-On Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing service delivery frameworks face challenges in managing sessions and imposing access constraints securely across multiple services, leading to user discomfort due to the need for multiple authentications.
Innovation Solution
A distributed session management system utilizing multiple session managers to generate and manage service-session IDs, allowing single sign-on and secure access to multiple services without requiring users to authenticate multiple times.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a user authenticates to multiple services individually, then security and access control are maintained, but user convenience and ease of operation deteriorate
Solution Approach 1:
The system segments authentication into two distinct phases: initial authentication to obtain a master session ID, and subsequent service-specific authentication using service-session IDs. This segmentation allows the system to maintain security through service-specific credentials while improving user convenience by eliminating repeated authentication requirements.
Solution Approach 2:
The session management system acts as an intermediary between the user and multiple services. It generates and manages service-session IDs that serve as intermediaries for authentication, allowing users to access multiple services without direct repeated authentication while maintaining security through the session management infrastructure.
2Reliability
If service-session IDs are generated for each service, then security isolation between services is improved, but system complexity increases
Solution Approach 1:
The session management system provides universal functionality by handling authentication for multiple services through a unified mechanism. It generates both master session IDs and service-specific session IDs using the same underlying system, allowing secure access to diverse services without requiring separate authentication mechanisms for each service.
Solution Approach 2:
The system creates service-session IDs as copies or derivatives of the master session ID, tailored for specific services. This copying approach maintains security isolation between services while leveraging the existing master authentication, thereby reducing the need for completely separate authentication systems for each service.
3Adaptability or versatility
If multiple authentication sessions are managed separately, then service independence is maintained, but time consumption for authentication increases
Solution Approach 1:
The system performs preliminary authentication to establish a master session ID before accessing individual services. This preliminary action eliminates the need for repeated authentication when accessing multiple services, significantly reducing authentication time while maintaining service independence through service-specific session IDs.
Solution Approach 2:
Once the master session ID is obtained, the system maintains continuous authentication state across multiple service accesses. Service-session IDs extend the authentication continuity to specific services without requiring re-authentication, allowing users to seamlessly access multiple services while maintaining service independence.
Data Source
Figure 1~2
Figure 3
AI summary
It is described a distributed session manager solution, involving at least two session managers (304, 305) which upon receiving authentication information (310) of a client (302) by at least one of these session managers generates a client-related service-session ID (354, 358) for each of at least two services (308-1, 308-2, 308-3) accessible by the client (302). A single login of the client (302), and hence of the user, is sufficient to access each of these at least two services (308-1, 308-2, 308-3). Due to the distributed nature of embodiments of the invention, this principle is applicable even for highly distributed systems having several entities (304, 305) that perform session management.