Signed Security Token Mechanism for Remote Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face inconvenience and security risks when repeatedly entering usernames and passwords to access remote software features, as well as the risk of unauthorized access if credentials are compromised.
Innovation Solution
A system that uses a client device to access a first private key, transmit a signed access request to an authorisation server, and receive a signed security token with a finite lifetime, allowing secure access to remote server features without manual credential entry, utilizing machine-based authorisation and cryptographic keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If username and password authentication is used for accessing remote software features, then user identity verification is achieved, but user convenience deteriorates due to repeated credential entry and reset procedures
Solution Approach 1:
The system performs preliminary authentication by issuing security tokens after initial login, allowing users to access remote features without repeated credential entry. The token is obtained in advance and used for subsequent access requests, eliminating the need for repeated username/password entry while maintaining security.
Solution Approach 2:
Security tokens act as an intermediary between user credentials and remote feature access. Instead of directly using username and password for each access request, the system introduces tokens as a mediator that carries authentication information, simplifying the access process while maintaining verification reliability.
2Reliability
If username and password are used for authentication, then user identity can be verified, but security risk increases due to potential credential compromise
Solution Approach 1:
The system uses short-lived security tokens instead of long-term credentials like usernames and passwords. These tokens have limited validity periods and can be revoked, reducing the window of opportunity for unauthorized access. If a token is compromised, it can be invalidated without affecting the user's permanent credentials.
Solution Approach 2:
The system extracts the authentication proof from the original credentials (username/password) and separates it into transferable security tokens. This extraction allows the authentication information to be used without exposing the actual credentials, reducing the risk of credential compromise while maintaining authentication accuracy.
3Reliability
If manual credential entry is required for each access, then security control is maintained, but time consumption increases due to repeated login procedures
Solution Approach 1:
The system performs authentication preliminarily by issuing security tokens during initial login, storing them for subsequent use. This preliminary action eliminates the need for repeated login procedures, reducing time consumption while maintaining security control through token-based verification on subsequent accesses.
Solution Approach 2:
The security token enables continuous access to remote features without interrupting the user workflow for repeated logins. The token maintains authentication state continuously, allowing seamless access to protected features while the system continuously verifies the token's validity, thus maintaining security without time loss.
Data Source
AI summary
System comprising an authorisation server; a client device communicably coupled to the authorisation server and configured to execute an application program; and a remote server communicably coupled to the client device for providing an application feature to the application program. The application program is configured to, in response to receiving a user request to use an application feature: access a first private key; and transmit an access request signed with the first private key to the authorisation server. The authorisation server is configured to issue a signed security token signed with a second private key to the application program in response to receiving the signed access request. The signed security token has a finite lifetime within which the application program can access the requested application feature using the signed security token. The application program is configured to access the application feature from the remote server using the signed security token.