Authentication Intermediary for Security Device Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of security devices like smart cards or USB keys for user authentication in multiple applications leads to increased ergonomic burden and risk of secret interception, as users must repeatedly enter their PIN codes, which is less secure and less ergonomic compared to Single Sign-On (SSO) solutions.
Innovation Solution
A system and method that integrates a security device with an authentication mechanism, intercepting application requests, verifying user authentication, and authorizing access only to authorized applications, thereby minimizing the need for users to re-enter their secrets and enhancing security by centralizing secret management and monitoring unauthorized access attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users authenticate with a security device for each application, then security is improved, but ease of operation deteriorates due to repeated secret entry
Solution Approach 1:
The system performs preliminary authentication by intercepting the first authentication request from an application, authenticating the user through the security device, and storing the authentication result. Subsequent authentication requests are handled using the stored result, eliminating the need for repeated secret entry while maintaining security.
Solution Approach 2:
The system acts as an intermediary between applications and the security device. It intercepts authentication requests, manages the authentication process, and returns results to applications. This mediator role allows the system to handle authentication centrally, reducing repeated user interactions while maintaining secure access control.
2Reliability
If users repeatedly enter secrets for authentication, then security device functionality is maintained, but risk of secret interception increases
Solution Approach 1:
The system extracts the secret entry process from the authentication flow. By performing preliminary authentication and storing the result, the system removes the need for users to repeatedly enter secrets. The secret is entered only once during preliminary authentication, significantly reducing exposure to interception risks while maintaining security device functionality.
Solution Approach 2:
The system performs preliminary authentication before processing subsequent authentication requests. This preliminary action establishes the user's identity once, and the stored authentication result is reused for multiple applications or requests, minimizing the frequency of secret entry and reducing the window of opportunity for secret interception.
3Ease of operation
If SSO functionality is implemented without security devices, then ease of operation is improved, but security is reduced
Solution Approach 1:
The system merges the advantages of both approaches: it combines the automated authentication management of SSO with the strong security credentials of security devices. The preliminary authentication uses the security device for robust verification, while the stored authentication result enables SSO-like convenience for subsequent requests, achieving both security and ease of operation.
Data Source
Figure 1~2
Figure 3~4
Figure 5~7
AI summary
The system (1) has an interfacing unit (2) with a security device (3), interfacing unit (4) with a user (5), and an interfacing unit (6) with an application. An authentication unit (8) authenticates a legitimate user of the security device by requesting a secret e.g. password. A storage unit (10) stores the result of the authentication. A validation unit (12) is connected to the storage unit and the former and third interfacing unit, authorizes the request originating from the application destined for the security device when the user is authenticated. Independent claims are also included for the following: (1) a method for securing an application (2) a computer program product comprising a set of instructions for performing an application securing method.