Push Provisioning Session Binding for Secure App Data Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication device systems require users to manually enter account information into multiple applications and undergo separate authentication processes, which is cumbersome and poses a security risk due to potential interception of access data during transmission.
Innovation Solution
A push provisioning method where a first application on a communication device receives user input to select an account for provisioning to a second application, sends a session ID, and generates encrypted provisioning request data including user and device IDs, which is then validated by a remote server to securely provision access data to the second application, binding it to the device for exclusive use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If manual provisioning is performed for each application, then access data can be provisioned to multiple applications, but the process becomes cumbersome and adds friction to user experience
Solution Approach 1:
The system segments the provisioning process into two distinct phases: initial authentication phase where the user authenticates to the first application, and provisioning phase where access data is automatically pushed to the second application. This segmentation allows the system to handle multiple applications without requiring repeated manual authentication, thereby improving ease of operation while maintaining adaptability.
Solution Approach 2:
The system performs preliminary authentication of the user to the first application before enabling the provisioning process. This preliminary action establishes a secure foundation and generates a session identifier that will be used throughout the provisioning process, eliminating the need for repeated authentication steps when provisioning to multiple applications.
2Adaptability or versatility
If access data is transmitted through multiple applications, then provisioning can be achieved, but security risks increase due to potential interception of access data
Solution Approach 1:
The system introduces a session identifier as an intermediary element that links the first application (where authentication occurs) with the second application (where access data is received). This intermediary mechanism ensures that access data is transmitted securely through a controlled channel established during the initial authentication phase, preventing interception while maintaining provisioning capability across applications.
Solution Approach 2:
The system performs preliminary authentication and establishes a secure session before transmitting access data. This preliminary action creates a secure foundation that protects subsequent data transmission, ensuring that access data is only transmitted through authenticated channels and cannot be intercepted by unauthorized parties.
3Reliability
If separate authentication processes are required for each application, then each application can be secured independently, but the overall process becomes more complex and time-consuming
Solution Approach 1:
The system makes the first application universal by enabling it to serve both as the authentication gateway and as the provisioning initiator. The first application performs authentication for the user and then uses the generated session identifier to automatically provision access data to the second application. This multi-functionality eliminates the need for separate authentication processes for each application, reducing provisioning time while maintaining security.
Solution Approach 2:
The system merges the authentication process and the provisioning process into a single integrated flow. The authentication step and the provisioning step are combined into one continuous operation, where the session identifier generated during authentication is immediately used to initiate provisioning. This merging eliminates redundant authentication steps and significantly reduces the time required for provisioning.
Data Source
AI summary
Techniques for provisioning access data may include receiving, by a first application installed on a communication device, user input selecting an account to provision to a second application installed on the communication device. The first application may invoke the second application and send a session identifier (ID) to the second application. The second application may send a user ID associated with the second application, a device ID, and the session ID to the first application. The first application may then generate encrypted provisioning request data and send the encrypted provisioning request data to the second application. The second application may send the encrypted provisioning request data to a remote server computer to request access data that can be used to access a resource. The second application may receive the access data provided by the remote server computer based on validation of the encrypted provisioning request data.