Local Group Token Management for Selective Application Sign-Out
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single sign-on (SSO) solutions revoke the device token for all applications when a user signs out of one application, leading to a poor user experience as users are logged out of all applications simultaneously, even if they want to continue using others.
Innovation Solution
Implementing a local group registration system where client applications can register themselves to specific local groups upon installation, allowing for differential SSO treatment by using a shared device token that is not surrendered until it is no longer needed by other registered applications, enabling selective sign-out operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single device token is used for all applications in traditional SSO, then authentication simplicity is improved, but user experience deteriorates when signing out of one application forces sign-out from all applications
Solution Approach 1:
The patent segments the monolithic device token into multiple application-specific tokens, each associated with a particular application or group of applications. This allows the system to maintain multiple independent authentication states simultaneously, enabling selective sign-out while preserving SSO benefits for remaining applications.
Solution Approach 2:
The patent introduces dynamic token management where tokens can be individually created, activated, and revoked based on application-specific needs. The system dynamically adjusts which tokens are active and which are revoked, allowing flexible sign-out behavior without affecting other applications.
2Adaptability or versatility
If application-specific tokens are implemented for each application, then selective sign-out capability is improved, but system complexity increases due to multiple token management requirements
Solution Approach 1:
The patent merges the token management functionality into a centralized authentication module that handles multiple tokens uniformly. This centralization reduces complexity by providing a single point of control for token creation, storage, and revocation, rather than requiring separate management logic in each application.
Solution Approach 2:
The patent creates a universal token management system that can handle both single-application and multi-application scenarios through the same infrastructure. The system is designed to work with any number of applications and token types, reducing complexity through standardized processes rather than application-specific implementations.
3Productivity
If traditional SSO is used where one authentication serves all applications, then authentication efficiency is improved, but user experience worsens when users need to maintain different authentication states for different applications
Solution Approach 1:
The patent implements partial authentication revocation where only the necessary tokens are revoked when a user signs out of a specific application, rather than revoking all tokens. This partial action maintains authentication efficiency for remaining applications while improving user experience by allowing selective sign-out.
Solution Approach 2:
The patent applies different authentication states to different applications based on local requirements. Each application or group of applications can have its own authentication state, allowing the system to optimize for both efficiency (where SSO applies) and user experience (where selective sign-out is needed).
Data Source
AI summary
A computer implemented method and apparatus for sharing server resources. One or more applications are registered to a first local group on a device, and one or more applications are registered to a second local group on the device. If a user and device have been authenticated, and a device token already acquired for obtaining authorization for a first application of the first local group to access resources from a server, the same device token is available for use in obtaining authorization for a second application of the first group to access (share) resources from the server. Thus, the user need not re-submit authentication credentials to the authorization server. When the user signs out of an application of the same group, the sign out procedure is processed locally for all applications of the group. A device token is surrendered when it is not needed by applications of any other group.