Single Sign-On Authentication via Encrypted Secret Path Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current single sign-on systems are vulnerable to hijacking and manipulation due to the ease with which cookies can be stolen and shared across servers within the same domain, lacking effective security measures to prevent nefarious access.
Innovation Solution
A system that uses domain cookies with encrypted secret paths, where only servers with a matching domain can retrieve the cookies, and upon redirection, requests a domain-token cookie that can only be provided if the client's secret paths match, ensuring secure authentication and access to multiple resources without re-authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If domain cookies are used for single sign-on, then authentication flexibility and ease of access to multiple resources is improved, but security is worsened due to vulnerability to hijacking and manipulation
Solution Approach 1:
The patent segments the authentication system into multiple components: domain cookies for initial identification, encrypted secret paths for security, and domain-token cookies for final authentication. This segmentation allows each component to have a specific function, improving overall security while maintaining ease of operation.
Solution Approach 2:
The patent introduces an intermediary verification process using encrypted secret paths and domain-token cookies. This intermediary mechanism acts as a mediator between the domain cookie and final authentication, preventing direct hijacking while maintaining the convenience of single sign-on.
2Loss of time
If cookies are stored on the client for single sign-on, then authentication overhead is reduced, but vulnerability to theft and manipulation increases
Solution Approach 1:
The patent performs preliminary actions by encrypting the secret path before storing it on the client, and by establishing verification mechanisms in advance. This preliminary encryption and verification setup reduces authentication overhead while preventing theft, as the encrypted data cannot be used without the decryption key.
Solution Approach 2:
The patent changes the parameter of cookie storage from plain text to encrypted format. By transforming the secret path into an encrypted form, the system maintains the efficiency of client-side storage while eliminating the vulnerability to theft and manipulation.
3Adaptability or versatility
If any server within the same domain can retrieve domain cookies, then single sign-on functionality is enabled, but unauthorized access by rogue servers becomes possible
Solution Approach 1:
The patent applies preliminary anti-action by encrypting the secret path and requiring verification before allowing cookie retrieval. This preemptive security measure prevents rogue servers from accessing domain cookies, while still allowing legitimate servers to function properly.
Solution Approach 2:
The patent implements a feedback mechanism where servers must prove their legitimacy through encrypted secret path verification before being allowed to retrieve domain-token cookies. This feedback loop ensures that only authorized servers can access the system, maintaining single sign-on functionality while preventing unauthorized access.
Data Source
AI summary
One embodiment of the present invention provides a system that facilitates single sign-on of a client, wherein single sign-on allows the client to provide authentication credentials once during a computing session and to access multiple resources without re-authenticating. The system operates by receiving a domain cookie forwarded from the client by an application server at a single sign-on server, wherein the domain cookie includes a domain identifier and an encrypted secret path, and wherein the domain cookie can only be retrieved by servers whose domain matches the domain identifier in the domain cookie. The system then decrypts the encrypted secret path to reveal an unencrypted secret path. Next, the system redirects the client to the unencrypted secret path, wherein the unencrypted secret path is a path that terminates on the single sign-on server. Upon redirection, the system sends a request to the client from the single sign-on server requesting a domain-token cookie, wherein the domain-token cookie includes the domain identifier, a clear secret path, and encrypted information, wherein the request includes the clear secret path, and wherein the domain-token cookie can only be retrieved from the client if the client determines that the unencrypted secret path and the clear secret path match. Finally, upon receiving the domain-token cookie from the client at the single sign-on server, the system authenticates the client.