Single-Sign-On Security System with Distributed Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single-sign-on and reduced-sign-on systems do not provide privacy for users and lack secure data storage solutions, especially for sensitive data, as they do not ensure secure access and protection against data leakage or man-in-the-middle attacks.
Innovation Solution
A security system involving a first service provider and a second data storage provider, where a challenge request is sent with user identification, and an authentication message containing a user sign-on key is encrypted and signed, requiring both providers and the user to access data, minimizing exposure and preventing replay attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single-sign-on system is implemented to enable access to multiple service providers, then the ease of operation is improved, but the security and privacy of user data is worsened
Solution Approach 1:
The authentication system is segmented into multiple independent components: the user's device, the authentication server, and individual service providers. Each component has a specific role and none can access the complete authentication credentials alone. The authentication token is split into multiple encrypted parts distributed across different entities, ensuring that no single point of failure or compromise exists.
Solution Approach 2:
An authentication server acts as an intermediary between the user and service providers. It issues authenticated tokens without revealing the user's actual credentials to any service provider. The intermediary ensures that service providers can verify user identity without having direct access to sensitive authentication data, thus maintaining security while enabling convenient access.
2Ease of operation
If user credentials are stored locally on the user's device for access to multiple service providers, then the ease of operation is improved, but the security against data leakage is worsened
Solution Approach 1:
The sensitive authentication credentials are extracted from the user's local device and stored securely on a remote authentication server. The user's device only retains encrypted token fragments that are useless without the corresponding decryption keys held by the server. This extraction eliminates the security risk of local credential storage while maintaining convenient access through the token-based system.
Solution Approach 2:
Instead of storing actual credentials locally, the system creates and uses cryptographic copies (encrypted tokens) that can be transmitted to service providers. These tokens are mathematical representations of authentication status that can be verified without exposing the original credentials, thus enabling convenient access without the risk of credential leakage.
3Adaptability or versatility
If a cloud storage solution is used for data storage, then the accessibility is improved, but the trust relationship and security control are worsened
Solution Approach 1:
The system performs preliminary authentication and establishes a trusted relationship between the user and the authentication server before any data access occurs. The authentication token is issued in advance with embedded security credentials that prove the user's identity to service providers. This preliminary action creates a foundation of trust that enables secure cloud-based accessibility without compromising the trust relationship.
Solution Approach 2:
The system moves the trust relationship from the traditional cloud storage model (where the provider controls access) to a cryptographic dimension where mathematical proofs of authentication enable access. Instead of relying on the trustworthiness of cloud providers, the system uses cryptographic tokens that provide verifiable proof of authorization, adding a new dimension of security that is independent of provider trust.
Data Source
Figure 1
Figure 2
AI summary
A security system is provided for storing sensitive data and providing access to this data to at least one user (10) having an electronic communication device and using a single-sign-on procedure. A request (101) is directed to a first service provider (20). Based on the request (101) a challenge request (102) comprising the user identification code is sent to the second service provider (30); wherein the second service provider sends an authentication message (103) comprising the user identification code and an user Sign-On key to the first computer system, wherein the user Sign-On key is asymmetrically encrypted with a first service provider's (20) public key. Upon reception of the authentication message (103), the application of the first computer system creates an access ticket (104) comprising the digitally signed Sign-On key of the user, asymmetrically encrypted with a second service provider's (30) public key, wherein the content of said access ticket (104) is transmitted (105) to the user address from which the initial request (101) was initiated for a redirect (106) to the second computer system. The second service provider (30) starts a communication session with said user for accessing data in the data storage facility (31) after having checked the authentication of the user based on the basis of the user Sign-On key and a further part of the Sign-On key.