Polymorphic Authentication Token for Secure Session Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing desktop virtualization systems face challenges with user authentication, particularly in connection leasing scenarios, where long-lived sessions require secure and efficient authentication methods that are not vulnerable to theft or replay attacks, and are compatible with both online and offline access, while also addressing security and privacy concerns.
Innovation Solution
The implementation of an authentication token system using first and second authentication credentials, which are different from each other, such as user and device credentials, stored in various locations, and signed by a Root of Trust, allowing for polymorphic authentication tokens that enable secure single-sign-on and long-lived authentication sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used in desktop virtualization systems, then user authentication can be performed, but the system becomes vulnerable to theft and replay attacks
Solution Approach 1:
The authentication credentials are segmented into two distinct parts: a first credential (device identifier or public key) stored on the client device and a second credential (user password or biometric data) stored securely. This segmentation prevents either credential alone from being sufficient for authentication, thereby mitigating replay attacks and theft vulnerabilities while maintaining reliable authentication.
2Ease of operation
If long-lived authentication sessions are implemented for connection leasing, then user convenience is improved, but security risks increase
Solution Approach 1:
The system performs preliminary authentication using the first credential (device identifier or public key) stored on the client device before establishing a connection lease. This preliminary action enables the client to obtain a connection lease token that allows long-lived access without requiring repeated authentication, thus improving user convenience while maintaining security through the initial credential verification.
3Device complexity
If authentication credentials are stored in a single location, then system complexity is reduced, but security and privacy concerns increase
Solution Approach 1:
Authentication credentials are segmented and stored in different secure locations: the first credential (device identifier or public key) is stored in the client device's secure storage, while the second credential (user password or biometric data) is stored in a protected authentication service. This segmentation reduces security and privacy risks by ensuring that no single location contains all authentication information, while the overall system complexity remains manageable through standardized storage interfaces.
4Ease of operation
If cloud-based authentication services are used, then centralization and management ease are improved, but availability during cloud outages deteriorates
Solution Approach 1:
The system performs preliminary authentication using the first credential (device identifier or public key) stored locally on the client device before requiring connection to the cloud-based authentication service. This preliminary action enables the client to obtain a connection lease token that allows continued access during cloud outages, thus improving authentication availability while maintaining centralized management through the initial cloud-based credential verification.
Data Source
AI summary
A computing device may include a memory and a processor configured to cooperate with the memory to store an authentication token having first and second authentication credentials associated therewith. The first and second authentication credentials may be different from one another. The processor may further cooperate with a server to access a session based upon the authentication token.