SSO Authentication Server Reliability Adjustment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single sign-on (SSO) authentication systems do not effectively share security notifications across linked sites, limiting countermeasures to the site where suspicious behavior is detected, and inconvenience users by requiring repeated authentication.
Innovation Solution
A computer-readable medium implementing a process in an SSO authentication system that receives and authenticates user information across multiple linked sites, registers suspicious behavior, determines user reliability, and adjusts authentication information with reliability levels to restrict functions based on detected behavior, enabling seamless access while preventing unauthorized use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user authentication is performed at every site access, then security is improved, but user convenience deteriorates due to repeated authentication requirements
Solution Approach 1:
The system performs preliminary authentication at a first site before the user accesses a second site. The authentication result and reliability information are stored in advance, allowing the user to access the second site without repeating authentication. This preliminary action resolves the contradiction by establishing security credentials beforehand, eliminating the need for repeated authentication while maintaining security standards.
Solution Approach 2:
The authentication process is segmented into distinct phases: initial authentication at the first site, reliability determination, and subsequent access to the second site using stored credentials. This segmentation allows the system to separate the security verification step from routine access operations, providing strong security during initial authentication while enabling convenient access during subsequent operations.
2Device complexity
If suspicious behavior countermeasures are limited to the detecting site only, then system complexity is reduced, but security coverage deteriorates as other linked sites remain vulnerable
Solution Approach 1:
The authentication server is designed with multi-functionality, serving both as an authentication authority for individual sites and as a centralized security coordination hub for the entire linked site network. When suspicious behavior is detected at any site, the server universally applies countermeasures across all linked sites by adjusting authentication information and reliability levels system-wide. This universal approach extends security coverage to all sites while maintaining manageable system complexity through centralized control.
Solution Approach 2:
The system implements a feedback mechanism where suspicious behavior detected at any site triggers automatic countermeasures that are communicated back to the authentication server. The server then adjusts authentication information and reliability levels, which are subsequently applied across the network. This feedback loop ensures that security responses are coordinated system-wide rather than isolated to single sites, improving overall security coverage without requiring complex distributed decision-making at each site.
3Speed
If authentication information is transmitted without reliability adjustment, then processing speed is improved, but security control deteriorates as suspicious users maintain full access
Solution Approach 1:
The system dynamically changes parameters of authentication information by adjusting reliability levels based on user behavior. When suspicious behavior is detected, the reliability parameter is modified, which automatically adjusts the level of access and functions provided to the user. This parameter change approach maintains fast processing speeds because the adjustment is automated and based on pre-established reliability criteria, while simultaneously improving security control by restricting access for users with reduced reliability scores.
Data Source
AI summary
A computer readable medium storing a program causing a computer to execute a process for authenticating a user in a site included in an authentication system in which a plurality of sites are linked each other, the process comprising: receiving authentication information; authenticating the user in a first site of the authentication system based on the received authentication information; receiving suspicious behavior information of the user; registering the received suspicious behavior information; determining reliability of the user based on the suspicious behavior information registered in registering of the behavior information registration; in a case where the user accesses a second site of the authentication system, adding the reliability of the user determined, and transmitting the authentication information to which the reliability is added to the second site; and determining a function to be provided to the user in the first site based on the reliability of the user.