Single Sign-On Server Protecting User Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network-based software applications often compromise user privacy during the sign-on process, exposing personal information to third parties, leading to unwanted advertisements and spam, which can result in user dissatisfaction and loss of subscriptions.
Innovation Solution
A single sign-on configuration that protects user privacy by using a development server to manage user identifiers and authentication tokens without requiring users to share private information, allowing seamless access to multiple applications while keeping personal data secure from developers and third-party network servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the application provider handles user personal information in the sign-on process, then the operation is simplified, but user privacy is exposed to third parties
Solution Approach 1:
The patent introduces a server as an intermediary between the application and user authentication. The server handles the actual authentication process and user identifier management, while the application only interacts with the server through controlled interfaces. This intermediary architecture allows the application to benefit from centralized authentication management without directly accessing or storing sensitive user information, thus simplifying operation while protecting privacy.
Solution Approach 2:
The patent extracts the sensitive user information handling functions from the application and relocates them to a dedicated server. The application provider removes the capability to directly access user personal information, keeping only the minimal necessary interface for requesting authentication status. This extraction eliminates the privacy risk while preserving the operational benefit of centralized authentication management.
2Reliability
If user personal information is shared with developers, then authentication can be performed, but users receive unwanted advertisements and spam
Solution Approach 1:
The server acts as an intermediary that performs authentication using minimal identifiers (such as device identifiers or anonymized user identifiers) without requiring the application to access or process sensitive personal information. The server validates these identifiers and returns authentication status, ensuring reliable authentication while preventing the flow of personal information to developers that would lead to unwanted advertisements and spam.
Solution Approach 2:
The patent extracts sensitive personal information from the authentication process entirely. Instead of requiring personal information to be shared with developers for authentication, the system uses anonymized identifiers that the server can validate without exposing user identity to the application provider. This extraction eliminates the source of unwanted advertisements and spam while maintaining authentication reliability.
3Adaptability or versatility
If user identifiers are made accessible to applications, then applications can reference users, but user privacy is compromised
Solution Approach 1:
The server serves as an intermediary that manages user identifier references. Applications can request to reference users through controlled server interfaces, and the server provides anonymized or scoped identifiers that allow the application to reference users for functional purposes without exposing actual personal information. This maintains application versatility while protecting user privacy through the intermediary's controlled information disclosure.
Solution Approach 2:
The patent applies local quality by providing different types of identifiers for different purposes. Instead of giving applications full access to personal information, the server provides localized, purpose-specific identifiers that enable user reference only within the scope necessary for the application's function. This ensures adaptability for user reference while limiting privacy compromise to only what is strictly necessary for the specific application context.
Data Source
AI summary
A method of enabling applications to reference user information is provided, including receiving a request for a user identifier that references a user of the application and sending a second request for the user identifier to a server. The second request may include a second user identifier that references the user and a second authentication token for the second user identifier. Furthermore, the second user identifier and the second authentication token are not accessible by the user. The method includes receiving the user identifier and an authentication token for the first user identifier. The user identifier corresponds to the second identifier; and providing the user identifier and authentication token to the application. A method of enabling an application to identify users associated with a user of the application is provided; the method may include receiving, from the server, user identifiers that reference one or more users scoped to the application.