Hosted Desktop SSO via One-Time Token Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Single Sign-On (SSO) solutions fail to function effectively when a user attempts to access a website from a browser hosted on a desktop that is not their own computer, particularly in cloud-hosted scenarios, leading to a poor user experience due to the inability to transfer the identity token securely.
Innovation Solution
A method is implemented where a hosted desktop monitors local host ports for activity, receives a one-time-use token, verifies its authenticity, and then provides the user's identity token to the browser, which sends it encrypted to the website using the website's public key, enabling SSO without requiring additional credentials from the user.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional SSO solutions are used, then SSO works within the same computer or same Active Directory domain, but SSO fails when accessing cloud-hosted websites from hosted desktop sessions
Solution Approach 1:
The patent introduces a cloud-based authentication service as an intermediary between the hosted desktop session and cloud-hosted websites. This service receives authentication credentials from the hosted desktop, validates them, and establishes SSO tokens that work across different cloud services. The intermediary bridges the gap between the localized SSO mechanisms and cloud-based resources, enabling SSO functionality in hosted desktop scenarios where conventional solutions fail.
Solution Approach 2:
The patent creates a universal authentication mechanism that works across multiple cloud service providers and hosted desktop environments. By implementing a standardized authentication interface and token system that can interact with various cloud services (Azure AD, Google Workspace, etc.), the solution provides multi-functional SSO capability that adapts to different cloud ecosystems while maintaining consistent behavior across diverse desktop environments.
2Ease of operation
If user credentials are stored locally on each computer, then SSO can be implemented using LDAP databases, but security risk increases when accessing third-party sites
Solution Approach 1:
The patent extracts the authentication credential storage and management functionality from individual user computers and relocates it to a secure cloud-based authentication service. Instead of storing passwords locally on each device or in LDAP databases accessible from multiple points, the credentials are centralized in a secure cloud environment. This extraction eliminates the security vulnerability of local password storage while maintaining SSO convenience through centralized credential management.
Solution Approach 2:
The patent implements self-service authentication where the cloud-based authentication service automatically manages credential verification, token generation, and session management without requiring users to manually store or manage passwords across multiple devices. The system performs automatic authentication challenges, validates credentials through secure cloud-based processes, and handles token renewal, reducing both security risks and user burden.
Data Source
AI summary
Methods, systems, computer-readable media, and apparatuses method for performing single sign on for a user device to the Internet. A hosted desktop may monitor activity on one or more ports on a local host interface. The hosted desktop may detect a call to initiate a single-sign-on from the hosted desktop into a website. The website may be associated with a one-time-use token. A public key of the website may be retrieved based on verification of the one-time-use token. An identity token corresponding to a user may be obtained and the identity token may be encrypted based on the public key of the website. The encrypted identity token may be provided to the website to establish the single-sign-on on behalf of the user with the website.