Identity Provider Token Broker for Single Sign-On
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users and organizations face significant burdens due to the need for multiple sign-in credentials across various software applications, leading to increased authentication efforts and support inquiries for forgotten credentials.
Innovation Solution
A computer-implemented method facilitating single sign-on (SSO) using a client device that involves requesting an identity provider to verify user identity, obtaining a token with public and private portions, and invoking a trusted broker application to authorize SSO access to third-party applications, thereby streamlining authentication processes without requiring users to re-enter credentials for each application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users are required to provide separate sign-in credentials for every application, then security is maintained, but user burden and authentication time increase significantly
Solution Approach 1:
The patent introduces an identity provider (IDP) as an intermediary system that centralizes authentication. Instead of each application having its own credential verification, the IDP acts as a mediator that issues tokens to applications after verifying user credentials once, enabling single sign-on across multiple applications without compromising security
Solution Approach 2:
The identity provider serves multiple applications simultaneously with a single authentication process. The token issued by the IDP can be used across different applications, making the authentication system universal rather than application-specific, thereby reducing authentication time while maintaining security through centralized control
2Reliability
If users must manually enter credentials for each application, then application security is ensured, but ease of operation deteriorates
Solution Approach 1:
The system enables self-service authentication where users authenticate once with the identity provider and automatically gain access to multiple applications without manual credential entry for each application. The token-based system automatically handles authentication across applications, improving ease of operation while maintaining security through automated verification
3Adaptability or versatility
If separate credentials are maintained for each application, then access control is precise, but device complexity and system management burden increase
Solution Approach 1:
The patent extracts the credential management function from individual applications and consolidates it into a centralized identity provider. Applications no longer need to store or manage their own credentials; instead, they receive tokens from the IDP, simplifying device complexity while maintaining precise access control through the token-based authentication mechanism
4Reliability
If IT departments manage separate credentials for each application, then security is maintained, but productivity and support efficiency decrease
Solution Approach 1:
The identity provider provides universal authentication service to all applications, consolidating credential management into a single system. This reduces the number of credentials IT departments need to manage and supports multiple applications through a unified authentication mechanism, improving productivity and support efficiency while maintaining security through centralized control
Data Source
Figure 1
Figure 2
Figure 3
AI summary
After an initial user sign-on with an identity provider, and in response to an intention of the user to use a third-party application executing on a client device of the user and requiring user sign-on, the identity provider provides a client script to the third-party application. The client script facilitates user and application authentication and invokes a trusted broker application that interacts with the identity provider to enable the user to use the third-party application. The use of the trusted broker application provided by the identity provider frees the authors of third-party applications from the need to modify their applications to explicitly sign in with the identify provider.