Distributed Identity Authentication Using Session Key Certification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed networks face challenges in efficiently managing user identities for login, authentication, and authorization, particularly in a user-friendly and secure manner, especially when users have multiple devices accessing various applications.
Innovation Solution
A computer-implemented method involving an identity service that manages user accounts under a main user identifier, generates session public keys, and provides certifications to authenticate users across multiple devices and applications, using cryptographic key pairs and public key verification schemes to ensure security and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional authentication methods are used for each device separately, then security is maintained, but user operation complexity increases and authentication efficiency decreases
Solution Approach 1:
The patent merges multiple device-specific authentication processes into a single centralized identity service. Users authenticate once through the identity service, which then manages authentication across all devices. This combines scattered authentication operations into one unified process, reducing user burden and time loss while maintaining security through the service's coordination.
Solution Approach 2:
The identity service acts as a universal authentication mechanism that works across multiple devices and applications. Instead of device-specific authentication, the service provides a multi-functional authentication system that handles login, authorization, and identity management universally, improving ease of operation without sacrificing security.
2Reliability
If separate authentication is required for each device, then device security is ensured, but system complexity increases
Solution Approach 1:
The identity service serves as an intermediary between users and multiple devices. Instead of implementing complex authentication logic in each device, the service mediates authentication centrally, receiving authentication requests and distributing verified credentials. This reduces system complexity by centralizing management while maintaining security through the intermediary's coordination.
Solution Approach 2:
The identity service enables self-service authentication where users authenticate once and the service automatically manages credentials across devices. The system performs self-verification and credential distribution without requiring users to manually configure each device, reducing complexity while maintaining security through automated processes.
3Productivity
If centralized identity management is implemented, then authentication efficiency improves, but network dependency increases
Solution Approach 1:
The identity service performs preliminary authentication and issues credentials before users access devices. This advance authentication action allows users to operate devices independently once credentials are obtained, improving efficiency through pre-verification while maintaining adaptability by allowing offline device operation with pre-issued credentials.
Data Source
AI summary
According to an embodiment of an aspect of the invention, there is a computer-implemented method for authenticating users of a network. The method comprises steps of maintaining, by an identity service, user accounts under a main user identifier, wherein the user accounts support a method of authentication by the user. The method further comprises generating, by an application frontend, a session public key of a public key verification scheme and providing, by the application frontend, the session public key to the identity service. Further steps include obtaining, by the application frontend, a certification from the identity service, the certification comprising the session public key and an application user identifier. The application user identifier is derived from the main user identifier and an application frontend identifier.