Late Binding Token for Secure Mobile SSO
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile operating systems like iOS restrict direct memory access between applications, limiting Single-Sign On (SSO) capabilities by preventing secure credential sharing between applications from different vendors, which hampers secure passing of credentials and secrets.
Innovation Solution
Implementing late binding authentication using a Late Binding Token (LBT) that is generated, sent to a second device, and validated to allow secure access to resources without compromising security, enabling SSO capabilities even on OSes that restrict access between applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the mobile OS provides sandbox isolation to prevent direct memory access between applications, then security is improved, but Single-Sign On capabilities deteriorate because credentials cannot be securely shared between applications from different vendors
Solution Approach 1:
The patent introduces a key sharing service as an intermediary component that operates within the sandboxed environment. This service acts as a mediator between applications, allowing credentials to be shared indirectly through a trusted intermediary rather than through direct application-to-application access. The key sharing service receives authentication requests, manages credential distribution, and coordinates the authentication process between different applications while maintaining sandbox isolation.
Solution Approach 2:
The patent creates a copy of the credential sharing mechanism through the key sharing service. Instead of allowing direct access to original credentials, the system creates authenticated copies or representations of credentials that can be safely transmitted between applications. The service generates authentication tokens and credential representations that replicate the necessary access information without exposing the actual credential stores, enabling SSO functionality while preserving security boundaries.
2Reliability
If the OS restricts credential sharing between applications to maintain security, then security is improved, but ease of operation deteriorates because users must re-enter credentials for each application
Solution Approach 1:
The key sharing service serves as an intermediary that automates the credential management process. When a user authenticates once, the service intercepts the authentication credentials, securely stores them, and automatically provides them to subsequent applications that require access. This eliminates the need for users to manually re-enter credentials while maintaining security through the intermediary's controlled access management.
Solution Approach 2:
The system performs preliminary authentication and credential caching through the key sharing service. Before applications need credentials, the service has already obtained and securely stored them from the user's initial authentication. This preliminary action allows subsequent applications to receive credentials automatically without requiring additional user input, improving ease of operation while maintaining security through pre-established authentication.
3Adaptability or versatility
If applications from different vendors are allowed to share credentials, then Single-Sign On capability is improved, but security deteriorates because the sandbox isolation is compromised
Solution Approach 1:
The key sharing service acts as a trusted intermediary that enables credential sharing between applications from different vendors without compromising sandbox isolation. The service maintains the security boundaries by operating as a separate, controlled component that mediates all credential access requests. Applications interact with the service rather than directly with each other's credential stores, preserving vendor isolation while enabling SSO functionality across different applications.
Solution Approach 2:
The key sharing service provides a universal credential management interface that works across applications from different vendors. Instead of creating direct peer-to-peer credential sharing channels between each application pair, the service offers a single, standardized mechanism that any application can use to obtain credentials. This universal interface enables broad SSO capability while maintaining consistent security controls through the service's centralized management.
Data Source
AI summary
A late-binding token (LBT) is securely generated and provided to a device application. When the LBT is presented and validated, a resource associated with the presentation is bound to the LBT and authenticated for access to a service and provided valid credentials for accessing that service.