Single Sign-On Authentication with Multi-Factor Token Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single sign-on systems with multiple authentication factors face challenges due to the complexity of integrating application programming interfaces (APIs) and managing differing password policies across various domains, leading to security vulnerabilities and user password fatigue.
Innovation Solution
A method that initiates a login session with a primary server resource, transmits and validates login credentials, and uses a token to access secondary server resources, minimizing the number of passwords users need to remember and reducing password-related help desk calls by employing a second authentication factor such as a digital certificate.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple separate accounts and passwords are used for different server resources, then security is improved through individual access control, but user complexity and password fatigue increase
Solution Approach 1:
The patent combines multiple authentication factors (password, digital certificate, token) into a unified authentication system. The client presents multiple credentials simultaneously to the authentication system, which validates all factors before granting access to multiple server resources. This merging approach maintains strong security through multi-factor authentication while reducing user complexity by enabling single sign-on capability across different resources.
Solution Approach 2:
The authentication system is designed to be universal across multiple server resources. Once a user successfully authenticates with multiple factors to the primary server resource, the same authentication credentials and session token can be used to access secondary server resources without re-authentication. This multi-functionality allows the same authentication mechanism to serve multiple purposes and resources.
2Reliability
If multiple authentication factors are implemented, then security is enhanced, but system complexity and integration difficulty increase
Solution Approach 1:
The patent introduces an authentication system as an intermediary between the client and multiple server resources. This intermediary handles the complex validation of multiple authentication factors (password, digital certificate, token) centrally, rather than requiring each server resource to independently verify all factors. The authentication system mediates the authentication process and manages session tokens, simplifying the overall system architecture while maintaining enhanced security through multi-factor authentication.
3Adaptability or versatility
If separate authentication systems are used for each server resource, then domain independence is maintained, but integration difficulty and API complexity increase
Solution Approach 1:
The authentication system is designed with universal functionality that works across multiple independent server resources. Each server resource maintains its own authentication system and domain independence, but they all interface with the same client authentication mechanism using standardized protocols. The client presents credentials to the authentication system, which then facilitates access to multiple independent resources without requiring tight integration or custom APIs for each resource.
Data Source
AI summary
The authentication of a client to multiple server resources with a single sign-on procedure using multiple factors is disclosed. One contemplated embodiment is a method in which a login session is initiated with the authentication system of a primary one of the multiple server resources. A first set of login credentials is transmitted thereto, and validated. A token is stored on the client indicating that the initial authentication was successful, which is then used to transition to a secondary one of the multiple resources. A second set of login credentials is also transmitted, and access to the secondary one of the multiple resources is granted on the basis of a validated token and second set of login credentials.