Single Sign-On Mechanism for Common Access Card Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face cumbersome and disjointed login processes when accessing multiple applications, especially in large organizations, and compliance with DOD CAC mandates requires complex PKI solutions and infrastructure.
Innovation Solution
A single sign-on (SSO) mechanism that allows users to log in once and automatically access all permitted applications and services by presenting a common access card (CAC) and PIN, generating a valid token for the login session, thereby bypassing the need for multiple logins across disparate systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple separate logins are required for different applications, then each application can maintain independent security control, but the login process becomes cumbersome and time-consuming
Solution Approach 1:
The system segments the authentication process into two distinct phases: (1) Initial authentication where the user provides credentials once, and (2) Subsequent automatic authentication where the system presents credentials to multiple applications without user intervention. This segmentation allows security control to be maintained while eliminating repetitive login procedures.
Solution Approach 2:
The system introduces an intermediary authentication mechanism that acts as a mediator between the user and multiple applications. This intermediary handles the credential presentation and authentication coordination, allowing the user to authenticate once and gain access to multiple applications without manual re-entry of credentials.
2Ease of operation
If a centralized authentication system is implemented, then the login process is simplified, but the system complexity increases due to PKI infrastructure requirements
Solution Approach 1:
The authentication system is designed with universality by accepting multiple types of credentials (user ID/password, digital certificates, biometric data) and presenting them to various application types (web-based, non-web-based, mainframe). This multi-functional approach simplifies the login process while managing infrastructure complexity through a unified authentication framework.
Solution Approach 2:
The system creates and manages copies of authentication credentials and authentication tokens that can be presented to different applications. By copying and distributing authentication information securely, the system enables simplified login processes without requiring complex direct integration with each application.
3Productivity
If automatic login is implemented for all applications, then user efficiency increases, but security risks increase due to credential exposure
Solution Approach 1:
The system performs preliminary authentication actions by verifying user credentials and generating authentication tokens before automatic login to applications. This preliminary action ensures that credentials are not exposed or misused, as they are validated and controlled by the authentication system before being automatically presented to applications.
Solution Approach 2:
The authentication system implements feedback mechanisms that monitor, control, and manage credential usage. By providing feedback on authentication status and credential validity, the system maintains security while enabling automatic login, allowing administrators to control and respond to authentication events in real-time.
Data Source
AI summary
A mechanism eliminates the number of times a user must login to individual services after initially logging into a computer system. A user only logs once into a computer system, and subsequent login requests by multiple services are handled automatically and transparently by the system. In one implementation, a user need only present a card to a card reader and enter a PIN, and the user is logged-in after presenting the card and a valid PIN. The system generates a token that is valid for this particular login session of the user, and when the user accesses a permissioned service, the system automatically logs-in the user to the application using the token. The system can perform the automatic login the user to a variety of applications including legacy applications, web-enabled applications, and commercial, off-the-shelf applications.