Mobile SSO via Independent Browser Token
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices face redundancy and security risks due to multiple native applications requiring separate authentications, despite sharing the same credentials, leading to inefficiencies and potential security vulnerabilities.
Innovation Solution
Implementing a single sign-on (SSO) method where native mobile applications leverage an independent browser to perform authentication using a persistent token, allowing shared authentication across multiple apps without re-authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each client app performs separate authentication, then each app can securely access its service, but users must authenticate multiple times creating redundancy and inefficiency
Solution Approach 1:
The patent merges authentication functionality into a shared component that serves multiple client apps. The authentication module is instantiated once and reused across different apps, allowing a single authentication event to validate multiple applications. This eliminates redundant authentication while maintaining security through centralized credential verification.
Solution Approach 2:
The authentication module is designed with universal functionality to serve multiple client applications. It can authenticate different apps using the same credentials through interprocess communication, making the authentication mechanism multi-functional rather than app-specific. This universal approach reduces authentication overhead while maintaining app-specific security requirements.
2Reliability
If mobile device platform restrictions prevent interprocess communication, then app security is maintained, but multiple redundant authentication requests occur
Solution Approach 1:
The patent introduces an intermediary authentication module that acts as a mediator between multiple client apps and the security system. This intermediary component receives authentication requests from different apps, processes them through a shared authentication instance, and returns results. It bridges the gap between platform security restrictions and the need for efficient authentication.
Solution Approach 2:
The authentication system is segmented into separate functional components: the authentication module that handles credentials, the token management system, and the client apps. This segmentation allows the authentication logic to be reused across apps while maintaining security boundaries. Each app interacts with the shared authentication module through defined interfaces, preserving security while enabling efficiency.
3Ease of operation
If a user logs out of one app, then that app loses access, but other apps using the same credentials remain logged in creating security risks
Solution Approach 1:
The authentication module implements feedback mechanisms that track authentication state across all client apps. When a logout event occurs in one app, the system provides feedback to the centralized authentication module, which then propagates the logout state to all other apps using the same credentials. This ensures consistent security state across the entire system.
Solution Approach 2:
The patent extracts the authentication state management from individual app instances and centralizes it in a shared authentication module. The authentication credentials and session state are extracted from app-specific storage and managed centrally. This allows a single logout action to invalidate credentials system-wide, eliminating the security risk of lingering sessions in other apps.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Features are disclosed for authentication of mobile device applications using a native, independent browser using a single-sign-on system. An authentication module within the mobile application can direct the mobile device's native browser to a URL to initiate authentication with an authentication appliance. The mobile browser can receive and store a browser-accessible token to indicate previous authentication performed by the user. The mobile application can receive from the application appliance and store a client application ID token that may be presented to network services for access. A second mobile device application may direct the same browser to the authentication appliance. The authentication appliance may inspect the persistent browser-accessible token and issue a second client application ID identity to the second application without collecting additional authentication information, or collecting additional authentication information that is different from the first authentication information.