IDAAS Server Mediator for Web Authentication Confidentiality
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods for web applications compromise user data and activity confidentiality, particularly when using social authentication services that share unnecessary personal data and track user activity across multiple applications.
Innovation Solution
A method involving an Identity as a Service (IDAAS) server that intermediates user authentication with a social server, where personal data is verified against access rules on the IDAAS server without being transmitted to the application server, ensuring only a proof of authentication is shared, thus maintaining user data and activity confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a social authentication service is used to authenticate users, then user authentication is simplified and personal data does not need to be entered in each application, but the social authentication service transmits unnecessary personal data to each web application and can track user activity across applications
Solution Approach 1:
The patent introduces an IDAAS server as an intermediary between the social authentication service and the application server. The IDAAS server receives personal data from the social server, verifies it against access rules, and then transmits only a proof of authentication to the application server without forwarding the actual personal data. This mediator architecture simplifies user authentication while protecting user data confidentiality by preventing unnecessary data transmission.
2Reliability
If personal data is transmitted to the application server for verification, then access control rules can be enforced, but user data confidentiality is compromised
Solution Approach 1:
The patent extracts only the essential verification function from the application server by implementing access control rules on the IDAAS server. The IDAAS server verifies personal data against predefined access rules and extracts only the necessary authentication proof, leaving the actual personal data confined to the IDAAS server. This ensures reliable access control while maintaining user data confidentiality.
3Reliability
If the social authentication service knows which application the user wishes to access, then proper authentication can be performed, but user activity confidentiality is compromised through tracking and tracing
Solution Approach 1:
The patent segments the authentication process into distinct functional components: the social server handles user identification and personal data storage, the IDAAS server handles access rule verification and authentication proof generation, and the application server handles the actual application logic. This segmentation ensures that no single server has complete information about user activity, thereby maintaining user activity confidentiality while ensuring authentication accuracy.
Data Source
AI summary
The invention relates to a method (100) for authenticating a user to access a web application, comprising:reception, by an application server, of an access request;redirection (114) to an IDAAS authentication server;authentication (126) of said user with a social authentication server selected from said IDAAS server,reception (128) by said IDAAS server of said user's personal data,verification (132) of personal data, andwhen the personal data satisfies at least one web application access rule, transmission (136) of a proof of authentication authorizing said user to access said web application.It also relates to a computer program and an authentication system implementing such a method.