Host Application Unified Authentication for Guest Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing popularity of applications poses challenges for users as they struggle to manage and remember multiple sets of credentials for different applications, leading to inconvenience, security risks, and reduced usage due to the time-consuming process of authentication and authorization.
Innovation Solution
A host application is used to determine whether a user of a client device is allowed to perform actions within a guest application by receiving and comparing user information, action requests, and permissions, allowing for a unified authentication process through token generation and communication between the host and guest applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users provide credentials for each application individually, then each application can verify user identity securely, but users face difficulty memorizing multiple credential sets and experience time-consuming authentication processes
Solution Approach 1:
The patent combines multiple credential verification processes into a single unified authentication system. A host application consolidates credential storage and management, allowing users to authenticate once and access multiple guest applications without repeatedly entering credentials. This merging resolves the contradiction by maintaining security through centralized verification while improving ease of operation through single-point authentication.
Solution Approach 2:
The host application serves as a universal authentication service that can verify user credentials across multiple different guest applications. Instead of each application requiring separate credential systems, the host application provides multi-functional credential verification that works universally across the application ecosystem, thereby reducing the number of credential sets users must manage while maintaining security.
2Ease of operation
If users store credentials for multiple applications, then access is convenient, but security risks increase and private information may be compromised in case of breach
Solution Approach 1:
The host application acts as an intermediary between users and guest applications for credential management. Instead of users directly storing and managing credentials across multiple applications (which creates security vulnerabilities), the host application mediates the authentication process by securely storing credentials centrally and providing verification services. This intermediary role maintains convenience while reducing security risks through centralized, controlled access.
Solution Approach 2:
The patent extracts credential storage and management functionality from individual guest applications and consolidates it into a separate host application. By taking out the credential management responsibility from multiple potential attack vectors (each guest application) and centralizing it in a dedicated security-focused host application, the system maintains convenient access while reducing the attack surface and security breach risks.
3Reliability
If users reset credentials frequently due to forgetting or misplacing them, then security can be maintained, but time is lost and user experience deteriorates
Solution Approach 1:
The host application merges credential recovery processes into a unified system. When users forget credentials, instead of resetting them in each individual application (which is time-consuming), the recovery process is centralized in the host application. This allows users to reset credentials once through the host application, and the updated credentials are automatically available across all connected guest applications, thereby maintaining security while significantly reducing the time loss associated with credential resets.
Data Source
AI summary
An online system receives information describing a request from a user to perform an action within a guest application and information identifying a host application for determining whether to allow the user to do so. The information describing the request is communicated to the host application for comparison to a set of permissions. Upon receiving information indicating the information describing the request matches a permission identifying a user allowed to perform an action within the guest application, the online system communicates, to the host application, a message for display to the user including an option allowing the user to perform the action within the guest application. Upon receiving a selection of the option at the host application, the online system receives a token allowing the user to perform the action within the guest application and communicates it to the guest application. The host and guest applications also may communicate directly.