Single Sign-On Agent Automating One-Time Password Delivery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems face challenges in combining the security of one-time passwords (OTPs) with the convenience of single-sign-on (SSO) applications, particularly in remote access scenarios where users must frequently authenticate and manage multiple OTPs, leading to increased security risks and user frustration.
Innovation Solution
A client-resident SSO agent automates the delivery of pre-stored OTPs into log-on screens, enabling secure and convenient access to secure networks by authenticating users offline and decrypting stored OTPs for verification by a back-end authentication server, even in situations where a trustworthy channel to a remote SSO server is lacking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OTP-based authentication is used to enhance security, then security is improved, but user convenience deteriorates due to frequent manual credential entry and transcription
Solution Approach 1:
The system pre-stores multiple OTP credentials in a credential store before they are needed. When authentication is required, the SSO agent automatically retrieves and uses the pre-stored OTP without requiring the user to manually obtain or transcribe the code, thus maintaining security while improving convenience
Solution Approach 2:
The SSO agent automatically manages the authentication process by selecting appropriate credentials from the credential store, filling in log-on forms, and handling OTP delivery without user intervention. The system serves itself by automating the entire authentication workflow
2Ease of operation
If SSO systems use static passwords for automated authentication, then ease of operation is improved, but security deteriorates because static passwords cannot be used with single-use OTPs
Solution Approach 1:
The system transitions from static passwords to dynamic OTP credentials that change over time. The credential store maintains multiple OTP values with different lifespans, allowing the SSO agent to automatically use current valid OTPs while maintaining the automated convenience of SSO
Solution Approach 2:
The system changes the parameter of password validity from static (unchanging) to dynamic (time-limited). OTPs have defined lifespans and are automatically rotated, transforming the authentication mechanism while preserving automated access through the SSO agent
3Reliability
If multiple OTPs are required for wireless access and VPN connection, then security is improved, but loss of time increases due to waiting periods between code usage
Solution Approach 1:
The system pre-stores multiple valid OTP credentials in the credential store before they are needed for authentication. The SSO agent can immediately retrieve and use these pre-prepared codes without requiring the user to wait for new codes to be generated or delivered, eliminating delays while maintaining the security of multiple OTP requirements
Solution Approach 2:
The credential store maintains a continuous supply of valid OTP credentials ready for immediate use. As one OTP is consumed, another is already available in the store, ensuring continuous authentication capability without interruption or waiting periods
Data Source
AI summary
Embodiments of the invention facilitate the use of a contactless memory token to automate log-on procedures to a remote access server using dynamic one-time passwords (OTPs). A series of workflow steps establishes the identity of the user and charges a token with a number of dynamic OTPs that can be subsequently verified using, for example, a Radius server sitting behind a VPN or SSL/VPN server.