Cross-Application Authentication via Network Session Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods require users and devices to perform separate authentication procedures for each application, leading to a cumbersome user experience and potential security vulnerabilities due to the lack of seamless cross-application authentication.
Innovation Solution
The implementation of a session token mechanism that authenticates users and devices across multiple applications without relying on the operating system or application programming interface, using network-based authentication mechanisms and identifiers like MDN, IMSI, or IMEI, allowing for cross-application authentication while maintaining security through signature verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate authentication procedures are performed for each application, then security is maintained for each individual application, but user experience becomes cumbersome and time-consuming
Solution Approach 1:
The system performs preliminary authentication at the network level before application-specific authentication. The network authentication server validates the UE's identity and establishes a base authentication state that is reused across multiple applications, eliminating the need to repeat the entire authentication process for each application.
Solution Approach 2:
The authentication process is segmented into two independent layers: network-level authentication (handled by the authentication server using identifiers like IMSI, MDN, or IMEI) and application-level authentication (handled by individual applications). This segmentation allows the network layer to handle complex security verification while the application layer benefits from the pre-established trust relationship.
2Reliability
If separate authentication procedures are performed for each application, then application-specific security is ensured, but device complexity increases due to multiple authentication mechanisms
Solution Approach 1:
The network authentication server acts as an intermediary between the UE and multiple applications. It centralizes the complex authentication logic and security verification, returning simplified authentication results to individual applications. This mediator approach reduces device complexity by offloading heavy authentication processing to the network infrastructure.
Solution Approach 2:
The network authentication server provides universal authentication services to multiple applications simultaneously. A single authentication instance validates the UE's identity across all applications that rely on this authentication mechanism, eliminating the need for each application to implement its own complete authentication stack.
3Ease of operation
If platform-specific authentication APIs are used, then integration with operating system is achieved, but cross-platform adaptability is reduced
Solution Approach 1:
The authentication mechanism extracts the platform-specific API dependency and relocates it to the network layer. The UE's network authentication client communicates with the network authentication server using standardized protocols, while application-specific authentication requests are handled through a platform-agnostic interface that translates between application needs and network authentication capabilities.
Data Source
AI summary
A system described herein may receive an authentication request from a User Equipment (“UE”). The authentication request may include a particular identifier, such as an application group identifier. The system may determine whether a token is available (e.g., has been previously generated) for the UE and the particular identifier. If such token is not available, the system may initiate an authentication procedure that includes receiving input from the UE, and may generate the token, indicating that the authentication procedure has been completed. If the token is available, then the system may forgo initiating the authentication procedure. The system may output the token, such that a service provider system authenticates the UE based on the generated token and provides services to the UE based on authenticating the UE.