Identity Validation via Attribute Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single sign-on services do not adequately ensure user security, as they remain vulnerable to intruders who intercept credentials, potentially exposing all associated services if the single sign-on service is compromised.
Innovation Solution
A method for validating a principal's true identity involves receiving a sign-on token, requesting and comparing first principal attributes from an identity service with second attributes independently acquired, ensuring that only authenticated access is granted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If single sign-on services are used to manage multiple identities, then ease of operation is improved, but security is worsened due to vulnerability to credential interception and service exposure
Solution Approach 1:
The patent segments the authentication process into multiple independent validation stages: initial credential verification, attribute comparison between identity service and local storage, and continuous validation. This segmentation ensures that compromise of one stage does not affect others, resolving the contradiction by maintaining ease of operation through automated multi-stage validation while improving security through distributed verification.
Solution Approach 2:
The patent introduces an intermediary validation mechanism that compares attributes from the identity service with locally stored attributes before granting access. This intermediary layer acts as a mediator between credential issuance and access granting, ensuring that even if credentials are intercepted, the additional attribute comparison prevents unauthorized access, thus improving security without complicating user interaction.
2Reliability
If credentials are stored and validated centrally, then security is improved through centralized control, but device complexity increases due to additional validation layers
Solution Approach 1:
The patent performs preliminary action by pre-storing authentication attributes and validation rules in the system before actual authentication occurs. This allows the validation mechanism to operate using pre-configured data structures and comparison logic, improving security through comprehensive pre-validation while avoiding the complexity of real-time attribute generation and reducing the need for complex dynamic validation frameworks.
Solution Approach 2:
The patent changes the validation parameters from complex cryptographic verification to straightforward attribute comparison between stored and retrieved data. By transforming the validation mechanism into a parameter-based comparison system rather than complex cryptographic validation, the patent achieves enhanced security through thorough attribute verification while minimizing device complexity through simplified validation logic.
3Reliability
If continuous validation is performed, then security is improved through ongoing verification, but loss of time increases due to multiple validation steps
Solution Approach 1:
The patent implements periodic validation rather than continuous validation, performing attribute comparison at specific authentication milestones (initial login, attribute retrieval, access granting). This periodic approach maintains security through regular verification while minimizing time loss by avoiding constant validation overhead, resolving the contradiction through strategically timed validation checks rather than continuous monitoring.
Solution Approach 2:
The patent ensures continuity of useful action by maintaining validated authentication state across multiple operations once initial validation succeeds. The system continues to trust the authenticated session without repeatedly validating credentials for every subsequent operation, thereby maintaining security through ongoing valid authentication while avoiding the time penalty of repeated validation steps for the same user session.
Data Source
AI summary
Techniques for validating identities are provided. A sign-on request is authenticated for a given principal. Attributes associated with that principal are acquired from an identity service and compared against local maintained attributes for that principal. If the identity-service acquired attributes match the local attributes, then the principal is validated for access. During principal access, selective events drive updates to the identity-service acquired attributes, and the comparison with the local attributes is performed again to determine whether the validated principal is to be invalidated or is to remain validated.