Proof-of-authentication module for single sign-on
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication methods require repeated entry of authentication information for multiple accesses to applications or resources, and existing solutions like Kerberos require modifications to applications and communication protocols.
Innovation Solution
A single sign-on authentication system using a proof-of-authentication module that interacts with a standard authentication component to generate and manage proof-of-authentication values based on a ticket, allowing multiple access requests without requiring changes to existing applications or protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional authentication methods are used, then security is maintained, but repeated entry of authentication information is required for multiple accesses
Solution Approach 1:
The system performs preliminary authentication once and issues a ticket that can be used for multiple subsequent access requests. This preliminary action eliminates the need for repeated authentication entries, allowing users to access multiple applications without re-entering their credentials.
Solution Approach 2:
A ticket serves as an intermediary credential between the user's initial authentication and subsequent access requests. The ticket is issued by an authentication authority and can be presented to multiple applications, acting as a mediator that enables multiple accesses without requiring the user to re-authenticate.
2Ease of operation
If Kerberos authentication is used, then multiple accesses are enabled, but applications and communication protocols must be modified
Solution Approach 1:
The authentication ticket can be used across multiple different applications and resources without requiring each application to implement specialized Kerberos protocols. The ticket serves a universal function that works with standard authentication components, enabling single sign-on without modifying existing applications or communication protocols.
Solution Approach 2:
Instead of requiring applications to implement complex authentication protocols, the system uses a simplified ticket that copies the authentication authority's verification capability. The ticket contains sufficient information for the authentication authority to verify identity without requiring the applications to perform complex authentication operations.
3Reliability
If time-synchronous password generation is used, then authentication security is maintained, but frequency of authentication is limited
Solution Approach 1:
The system performs the time-synchronous password generation as a preliminary action during the initial authentication, then issues a ticket that can be used for multiple subsequent authentications. This allows the security-based time-synchronous mechanism to be applied once without limiting the frequency of subsequent accesses.
Solution Approach 2:
The system dynamically switches from time-synchronous password generation to ticket-based authentication after the initial authentication. This dynamic adaptation allows the system to maintain security through time-synchronous methods while enabling frequent accesses through the flexible ticket mechanism.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A single sign-on technique allows multiple accesses to one or more applications or other resources using a proof-of-authentication module operating in conjunction with a standard authentication component. The application or other resource issues an authentication information request to the standard authentication component responsive to an access request from the user. The application or other resource receives, responsive to the authentication information request, a proof-of-authentication value from the standard authentication component, and authenticates the user based on the proof-of-authentication value. The standard authentication component interacts with the proof-of-authentication module to obtain the proof- of-authentication value. The proof-of-authentication module is configured to generate multiple proof-of-authentication values for authentication of respective access requests of the user.