Session Data Mediator for Secure Single Sign-On
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Single Sign-On (SSO) solutions, such as Kerberos, require the Service Provider (SP) to trust a Ticket-Granting Ticket (TGT) without verifying the logon session information, leading to potential security issues and user inconvenience due to repeated authentication prompts.
Innovation Solution
A method and system that utilize a Logon Agent (LAG) and Logon Application (LAP) to securely transmit session data from a user authentication server to a browser, which then verifies and authorizes access to the Service Provider (SP) based on valid session data, eliminating the need for re-entering credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If Kerberos TGT is used for single sign-on, then user convenience is improved by avoiding repeated credential entry, but security is worsened because the service provider must trust the TGT without verifying logon session information
Solution Approach 1:
The patent introduces session data as an intermediary element that bridges the trust gap between the client and service provider. The session data, generated during authentication and transmitted to the service provider, serves as a verifiable mediator that proves legitimate logon session occurrence without requiring the service provider to fully trust the TGT or handle actual credentials.
Solution Approach 2:
The patent implements preliminary action by having the authentication server generate and transmit session data to the client during the initial logon session, before the client needs to access services. This pre-prepared session data is then readily available for verification when accessing services, eliminating the need for repeated authentication while maintaining security through pre-validated session information.
2Reliability
If traditional authentication methods are used, then security is maintained by verifying credentials, but user convenience is worsened by requiring repeated authentication data entry
Solution Approach 1:
The patent extracts the essential verification element (session data) from the complete authentication process and separates it from the actual credentials. By taking out only the necessary session verification information and transmitting it to the service provider, the system maintains security verification without requiring users to re-enter sensitive authentication data, thus improving convenience while preserving security.
3Ease of operation
If session data is transmitted from logon application to browser, then seamless access is achieved, but system complexity increases due to additional components and data transmission steps
Solution Approach 1:
The patent makes the logon application multi-functional by having it serve both as the initial authentication interface and as the session data transmission mechanism. The same logon application that handles user login also manages session data extraction and transmission to the browser, eliminating the need for separate dedicated components and reducing overall system complexity while maintaining seamless access.
Data Source
AI summary
The invention method comprises: authenticating successfully, by a user authentication server, through a logon agent in a device, a device user; sending, by the user authentication server, to the logon agent, session data relating to the successful authentication session; sending, by the logon agent, to a logon application the session data; receiving, by at least one browser, from the device user, a first request for accessing the service with a first server identifier; sending, by the logon application, to the at least one browser, the session data; sending, by the browser, based on the first server identifier, to a first receiving server, the session data; verifying, by the first receiving server, whether the session data is or is not valid, and, if yes, authorizing access to the service.