Unified Single Sign-On Framework for Browser and Native Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the Windows 10 environment, there is no framework for achieving single sign-on capabilities for both native and web-based applications, requiring users to authenticate separately for each, leading to a less than desirable user experience due to repeated authentication requests.
Innovation Solution
A framework is developed that facilitates single sign-on by allowing an identity provider application to register as a local identity provider, utilizing authentication tokens and keys to authenticate users across various applications and services, leveraging APIs provided by the operating system to manage authentication and authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate authentication is implemented for web-based and native applications, then security is maintained for each application type, but user experience deteriorates due to repeated authentication requests
Solution Approach 1:
The patent merges the authentication mechanisms for web-based and native applications by introducing a unified authentication framework. The identity provider application registers as a local identity provider and issues authentication tokens that are recognized by both web browsers and native applications through the operating system's authentication interface, eliminating the need for separate authentication processes while maintaining security for both application types
Solution Approach 2:
The authentication token system is designed with universality, allowing a single authentication token issued by the local identity provider to serve multiple purposes across different application types. The token can be used by both web-based applications accessed through the browser and native applications installed on the device, providing multi-functional authentication capability that improves user experience while maintaining security
2Ease of operation
If a unified single sign-on framework is implemented across all applications, then user experience is improved by eliminating repeated authentication, but system complexity increases due to integration requirements
Solution Approach 1:
The patent introduces an intermediary component - the local identity provider application registered with the operating system - that mediates between the identity provider server and both web-based and native applications. This intermediary handles authentication requests from different application types, manages token issuance and validation, and coordinates communication between components, thereby simplifying the overall system architecture while enabling unified single sign-on functionality
Solution Approach 2:
The authentication system is segmented into distinct functional components: the identity provider server that issues tokens, the local identity provider application that registers with the operating system and manages tokens, the browser that handles web-based applications, and native applications that access the authentication interface. This segmentation allows each component to be developed and maintained independently while working together to provide unified single sign-on, reducing overall system complexity
3Speed
If authentication tokens are stored locally on the device, then authentication speed is improved for subsequent logins, but security risks increase from potential token exposure
Solution Approach 1:
The patent applies parameter changes by transforming the authentication token from a static credential into a dynamic, time-limited authorization凭证. The tokens are designed with expiration times and scope limitations, changing their security parameters to reduce risk. Additionally, the operating system's secure storage mechanisms are utilized to change the storage parameters, protecting tokens from unauthorized access while maintaining quick retrieval for authentication
Data Source
AI summary
Disclosed are various approaches for providing single sign-on capabilities for a user on a client device. A user's credentials can be authenticated by an identity provider application. The identity provider application can facilitate single sign-on capabilities for browser-based applications and native applications on the client device.