Mobile Terminal SSO Authentication via Relaying Party Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional mobile communication systems face security vulnerabilities in the Single Sign-On procedure, particularly in the transmission and verification of user identifiers, which can lead to phishing attacks and inefficient user authentication.
Innovation Solution
A method and system for secure user authentication in mobile communication systems, involving the transmission of user identifiers to a Relaying Party, receiving an OpenID authentication request, and verifying the validity of the Relaying Party and OpenID provider, ensuring secure Single Sign-On across networks like 3GPP EPS, EUTRAN, and GERAN.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the conventional Single Sign-On procedure is used for user authentication, then the user can access resources through identifier transmission, but security vulnerabilities arise that enable phishing attacks
Solution Approach 1:
The system performs preliminary verification of the Relaying Party's validity before processing the Single Sign-On authentication request. The terminal verifies whether the RP is a valid entity that can receive SSO requests, and checks whether the redirect URI matches the registered URI. This preliminary validation prevents phishing attacks by ensuring the user is authenticating with a legitimate service provider before any credential transmission occurs.
Solution Approach 2:
The invention introduces an intermediary verification mechanism where the terminal acts as an active intermediary between the user and the Relaying Party. Instead of directly transmitting identifiers to any received request, the terminal mediates by verifying the RP's validity and the redirect URI consistency. This intermediary layer blocks malicious RPs from receiving user credentials, thereby preventing phishing attacks while allowing legitimate SSO operations.
2Reliability
If the terminal verifies the Relaying Party validity through redirect request message, then security is improved, but the authentication procedure becomes more complex
Solution Approach 1:
The verification of Relaying Party validity and redirect URI matching is performed as a preliminary action before the main authentication flow. By checking these conditions upfront in the receiveRedirectRequest() function, the system avoids complex verification steps later in the authentication process. The terminal simply checks if the RP is valid and if the redirect URI matches the registered URI, then proceeds with standard SSO if both conditions are met.
Solution Approach 2:
The terminal performs self-verification of the Relaying Party using information already available in the redirect request message and its own registered URI. The verification logic is embedded within the terminal itself, eliminating the need for additional external verification servers or complex multi-party interactions. The terminal autonomously determines RP validity by comparing the received redirect URI with its registered URI, simplifying the overall system architecture.
Data Source
AI summary
A terminal and a user authentication method of a terminal in a communication system are provided. The terminal and the method include transmitting information including a user identifier to a Relaying Party (RP), receiving a redirect request message including a OpenID authentication request from the RP, and verifying validity of the RP based on the redirect request message.