Mobile SSO via Kerberos Ticket Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face inconvenience and security risks due to the need to repeatedly enter credentials for multiple applications and services on mobile devices, even when identity federation is employed, as cookies and application tokens are not shared across mobile applications.
Innovation Solution
A device management service facilitates single sign-on by managing security credentials and tokens, allowing users to authenticate once and access multiple linked applications without re-entering credentials, using a networked environment that includes a device management service, identity provider, key distribution center, and certificate authority.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If identity federation is employed to provide a single federated account for multiple applications and services, then the number of credentials users need to manage is reduced, but users still have to enter the federated account credentials separately for each application and service
Solution Approach 1:
The patent introduces a cookie as an intermediary mechanism that stores authentication information between the user's device and the federated identity provider. When a user accesses multiple applications and services, the cookie automatically transmits the authentication token, eliminating the need for manual credential re-entry while maintaining security. The cookie acts as a mediator that carries authentication state across different applications without requiring user intervention.
2Extent of automation
If cookies and application tokens are used for authentication, then authentication can be automated, but cookies and application tokens are not shared across mobile applications
Solution Approach 1:
The patent makes the cookie mechanism universal by configuring it to work across multiple different mobile applications and services that all use the same federated identity provider. The cookie is set to be accessible by all applications, enabling a single authentication token to serve multiple application contexts. This universal approach allows the same cookie-based authentication mechanism to function whether the user is accessing a social networking application, file sharing service, or any other federated service.
3Reliability
If users enter credentials repeatedly for each application, then each application can verify user identity independently, but user convenience deteriorates and security risks increase
Solution Approach 1:
The patent performs the authentication action in advance by obtaining the user's credentials and authentication token during the initial login process. The cookie stores this authentication information and automatically transmits it to subsequent applications without requiring the user to re-enter credentials. This preliminary authentication action eliminates repeated credential entry while maintaining security, as the stored token remains valid only for its intended purpose and time period.
Data Source
AI summary
Disclosed are various examples for single-sign on by way of managed mobile devices using Kerberos. For example, a certificate is received from a client device. In response, a Kerberos ticket-granting ticket is generated and sent to the client device. A request for a service ticket is later received from the client device. The request for the service ticket can include the ticket-granting ticket. The service ticket is then generated and sent to the client device. Subsequently, the service ticket is received from the client device and a security assertion markup language (SAML) response is sent to the client device in reply. The SAML response can provide authentication credentials for a service provider associated with the service ticket.