Secure Single Sign-On for Wrapped Apps via Keychain Ticket Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile devices lack an effective single sign-on (SSO) solution for multiple apps, requiring users to repeatedly log in to each app within an enterprise federation, which complicates secure credential storage and communication due to the higher risk of device compromise.
Innovation Solution
A method where a mobile device's operating system keychain is used to store and transmit login tickets between apps in the same federation, allowing one app to authenticate and log in other apps without user intervention, using a hashed random byte array for secure credential sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If login credentials are cached in the device's operating system keychain for SSO, then user convenience is improved by enabling automatic login across multiple apps, but security risk increases due to higher vulnerability to device compromise
Solution Approach 1:
The patent segments the authentication system into multiple independent components: individual app credentials are stored separately in the keychain rather than a single master credential, and each app has its own authentication context. This segmentation limits the impact of device compromise to individual apps rather than exposing all credentials simultaneously.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism where a login ticket is transmitted from the first app to the second app through the operating system keychain. This intermediary ticket system allows SSO functionality while maintaining security boundaries, as the ticket can be validated without exposing the original credentials.
2Reliability
If manual login is required for each app, then security is maintained by avoiding credential caching, but user convenience deteriorates due to repeated login requirements
Solution Approach 1:
The patent implements preliminary authentication in the first app where login credentials are entered once and a login ticket is generated and cached in the keychain. This preliminary action enables subsequent apps to authenticate without requiring users to re-enter credentials, providing SSO convenience while maintaining security through the ticket-based system.
Solution Approach 2:
The patent creates a copy of the authentication state in the form of a login ticket that can be transmitted to other apps. This ticket is a simplified representation of the credentials that enables authentication without exposing the actual sensitive information, allowing SSO while maintaining security.
3Adaptability or versatility
If login tickets are stored in the operating system keychain for credential sharing, then multi-app authentication is enabled, but complexity increases due to ticket management and validation requirements
Solution Approach 1:
The patent implements a universal login ticket format that can be used across multiple different apps within the same federation. The ticket structure and validation mechanism are designed to be app-agnostic, allowing the same SSO infrastructure to serve multiple authentication scenarios without requiring app-specific customization.
Solution Approach 2:
The patent incorporates feedback mechanisms where the second app validates the received login ticket against its authentication requirements and provides feedback to determine whether SSO authentication succeeds or fails. This feedback loop enables automatic authentication decisions without user intervention while maintaining proper security validation.
Data Source
AI summary
A mobile device user is able to execute an app in a federation of wrapped apps without having to login to that app provided that the user has already logged into another app in that federation. The federation of apps on the device uses multi-app authentication to enable the user to start subsequent apps after explicitly entering login credentials for another app in that federation. This feature is loosely referred to as single sign-on for apps in the federation. The multi-app authentication is implemented by giving the second app a chance to prove two facts. One that it knows where in the operating system keychain a login ticket is stored and two, what the hash value of a random byte array is. By showing these facts, the logged-into app can safely provide login credentials to subsequent app without the user having to enter a login name or password.