Secure Password-Based Single Sign-On via Isolated Directory Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password-based single sign-on processes are vulnerable to security breaches as credentials are transmitted over networks, potentially detectable by malicious users using debugging tools.
Innovation Solution
A secure password-based single sign-on system executes the sign-on process in a directory service's isolation environment outside the user's device, using a browser extension to receive and utilize a browser cookie for automatic access to web-based resources, ensuring credentials are not transmitted to the client device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If credentials are transmitted to the browser over the network for single sign-on, then automatic access to multiple resources is enabled, but security is compromised as credentials can be detected by malicious users using network debugging tools
Solution Approach 1:
The patent extracts the credentials from the network transmission path by executing the sign-on script in an isolated environment on the server side. The credentials are never transmitted to the client device; instead, only a browser cookie is sent back to the user's device, eliminating the security vulnerability while maintaining automatic access functionality.
Solution Approach 2:
The patent introduces a browser cookie as an intermediary between the credentials and the web-based resources. The cookie acts as a mediator that carries authentication information without exposing the actual credentials, allowing automatic access while preventing credential exposure to network eavesdroppers.
2Object-affected harmful factors
If a sign-on script is executed in an isolation execution environment outside the user's device, then credential security is improved, but the complexity of the system increases due to isolated environment setup and management
Solution Approach 1:
The patent creates a simplified copy of the sign-on process that runs on the server side within an isolated execution environment. Instead of requiring complex client-side security infrastructure, the system copies the essential authentication logic to the server, where it can execute securely without exposing credentials to the client device.
3Adaptability or versatility
If credentials are stored in a central directory and managed by an identity management system, then single sign-on functionality is achieved, but the risk of network interception and malicious detection increases
Solution Approach 1:
The patent inverts the traditional single sign-on architecture by moving the sign-on script execution from the client side to the server side. Instead of the user's browser executing the script and transmitting credentials, the server executes the script in an isolated environment and sends back only a cookie, reversing the flow of sensitive information.
Data Source
AI summary
A secure password-based single sign-on process enables a user to access a web application without the authorization credentials transmitted over a distributed computing network. A network directory service system utilizes an identity management system, outside of the client device, to execute a sign-on to a web-based resource in a Hyper-V container. The browser cookie from the sign-on process is returned to the client device in a sign-on script that the client-side browser uses to transition to the web portal or home page of the target web-based resource.