Mobile App SSO via Direct Identity Broker
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single sign-on (SSO) mechanisms for mobile applications are inadequate, as they often redirect users to untrusted servers for authentication, exposing credentials to malicious attacks and failing to encrypt storage, leading to security vulnerabilities.
Innovation Solution
Implementing a direct brokering system for identity authentication within mobile applications, where a portion of the binary code acts as a broker to establish encrypted authentication sessions with identity service providers, providing SSO services and securing user credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If mobile applications redirect to web servers for authentication using traditional SSO mechanisms, then users can access multiple web services with single credentials, but the applications become vulnerable to malicious attacks and credential theft
Solution Approach 1:
The patent introduces a broker component as an intermediary between the mobile application and the identity provider. This broker establishes a direct authentication session, preventing the application from being redirected to potentially malicious web servers while still enabling SSO functionality. The broker acts as a trusted mediator that verifies the legitimacy of authentication requests and protects credentials from exposure to untrusted servers.
Solution Approach 2:
The authentication process is segmented into distinct components: the mobile application, the broker, and the identity provider. By separating the authentication logic from the application code and handling it through a dedicated broker component, the system enables SSO while isolating the application from direct exposure to potentially malicious web servers, thus reducing security vulnerabilities.
2Ease of operation
If user credentials are stored in shared folders for application access, then authentication is simplified, but credentials become discoverable by malicious code
Solution Approach 1:
The broker serves as an intermediary that manages credential storage and access securely. Instead of storing credentials in easily accessible shared folders, the broker implements secure storage mechanisms and controls access to credentials, preventing malicious code from discovering and stealing them while maintaining authentication convenience for legitimate applications.
Solution Approach 2:
The patent implements protective layers (analogous to flexible shells) around credential storage through secure enclaves or trusted execution environments. These protective layers isolate credentials from the rest of the system, making them inaccessible to malicious code while still allowing authorized authentication operations to proceed smoothly.
3Device complexity
If mobile applications trust redirected web pages for authentication, then SSO flow is simplified, but applications risk being redirected to malicious websites
Solution Approach 1:
The broker acts as a trusted intermediary that verifies the legitimacy of authentication requests before allowing redirection. It checks whether the redirect is to a legitimate identity provider and establishes a secure authentication session, thereby maintaining a relatively simple authentication flow while preventing redirection to malicious websites and ensuring authentication security.
4Adaptability or versatility
If different web servers use different authentication steps and information requirements, then each service can be customized, but users must go through multiple log-in mechanisms
Solution Approach 1:
The broker implements a universal authentication interface that works across multiple identity providers and web services. It handles the complexity of different authentication requirements behind a unified interface, allowing users to authenticate once through the broker while each service maintains its customization needs. The broker translates between the universal interface and service-specific requirements, enabling both universality and adaptability.
Data Source
AI summary
Systems, methods, devices and non-transitory, computer-readable storage mediums are disclosed for single sign-on (SSO) for mobile applications using direct brokering for identity authentication. In an embodiment, a method comprises: sending, by a mobile application operating on a mobile device, a request to an online service provider for access to a resource; receiving, by the mobile application, a redirect from the service provider to an identity service provider for authentication; and establishing, by a portion of binary code of the mobile application and using the redirect, a brokered authentication session with the identity service provider, the portion of binary code configured to operate as a broker for the mobile application for the authentication session, and to provide single sign-on (SSO) services to the mobile application and other mobile applications operating on the mobile device, the SSO services including services to access the resources and authorization to use the accessed resources.