Multi-device SSO via Management Service Token
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In enterprise settings, users are typically required to authenticate multiple devices separately for single sign-on (SSO) access, which is cumbersome and inefficient, especially when using multiple devices such as laptops and smartphones.
Innovation Solution
A system that facilitates multi-device SSO by leveraging standards like SAML, where a management service manages user authentication across devices, allowing a single authentication on one device to be shared across others through a user-and-device token, eliminating the need for repeated authentication on each device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users authenticate each device separately for SSO access, then each device can be securely authenticated, but the authentication process becomes cumbersome and time-consuming
Solution Approach 1:
The system performs preliminary authentication by having the user authenticate once on a first device, then uses that authentication result to pre-establish trust relationships with additional devices. The management service stores device identifiers and authentication states in advance, so when a user adds a new device, the system can quickly verify the device against stored information without requiring full re-authentication.
Solution Approach 2:
The management service acts as an intermediary between the identity provider and multiple user devices. It receives authentication results from the identity provider, stores device identifiers and authentication states, and mediates the verification process when users attempt to access services from additional devices. This intermediary layer enables centralized management of multi-device authentication states.
2Reliability
If users provide authentication credentials from each device, then each device receives an authentication token, but the process becomes cumbersome when using multiple devices
Solution Approach 1:
The system implements multi-functionality by enabling a single authentication action to serve multiple devices simultaneously. The management service stores device identifiers and authentication states, allowing the system to recognize and authenticate multiple devices under a single user credential set. This universal authentication approach eliminates the need for device-specific authentication routines.
Solution Approach 2:
The system creates copies of authentication states across multiple devices. When a user authenticates on one device, the management service stores the authentication result and device identifier, then uses this stored information to generate appropriate authentication tokens for additional devices. This copying mechanism allows authentication credentials to be effectively replicated across devices without requiring users to manually provide credentials on each device.
3Reliability
If the system requires authentication from each device, then security is maintained, but user experience deteriorates in multi-device environments
Solution Approach 1:
The system performs preliminary verification by storing device identifiers and authentication states in advance. When a user attempts to access services from a new device, the management service checks the device identifier against stored information and verifies the authentication state, enabling quick security validation without requiring users to go through the full authentication process again.
Solution Approach 2:
The system implements feedback mechanisms where the management service continuously monitors and stores authentication states and device identifiers. This feedback loop allows the system to make real-time decisions about device authentication based on stored information, maintaining security while improving user experience by avoiding redundant authentication steps for trusted devices.
Data Source
AI summary
Disclosed are various approaches for extending a single sign-on (SSO) session to multiple devices. If a device is enrolled as a managed device with a management service, a SSO session can be extended to the device if the user has previously authenticated with an identity provider from another device. The user is authenticated on the second device using a user-and-device token issued by the management service with which the device is enrolled as a managed device.