SSO Credential Injection via Sandboxed User Account
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Single Sign On (SSO) technologies face security risks as shared SSO credentials can be accessed by end users, potentially leading to malicious operations, and current solutions like installing enterprise applications on remote servers limit user convenience.
Innovation Solution
Implementing a sandboxed user account and kernel driver-based system hooks to restrict end user access to SSO credentials, with the SSO tool and enterprise applications running under a restricted account, and using a kernel driver to prevent memory dumps and debugging.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SSO credentials are shared by multiple end users and stored in an SSO credentials vault, then user convenience and access efficiency are improved, but security risks increase as end users may access the credentials and perform malicious operations
Solution Approach 1:
The patent segments the user account into two distinct parts: a first user account for authentication purposes and a second user account for credential storage. This segmentation allows the SSO credentials to be associated with the second account while the first account maintains access rights, preventing end users from directly accessing the credentials while preserving authentication functionality.
Solution Approach 2:
The patent introduces an intermediary mechanism where the SSO credentials are injected into the application through a controlled process rather than being directly accessible to end users. The credentials are stored in the SSO credentials vault and injected by the system, acting as an intermediary between the vault and the application, thereby preventing direct user access while maintaining functionality.
2Reliability
If enterprise applications are installed on remote dedicated servers with limited user access, then SSO credential security is improved, but user convenience and access speed deteriorate
Solution Approach 1:
The patent performs preliminary actions by creating the sandboxed user account and configuring the SSO credentials vault before the end user logs in. The system pre-establishes the security infrastructure, including the first and second user accounts, so that when the user accesses the application, the credentials are already securely in place and the user experience remains seamless.
Solution Approach 2:
The patent moves the SSO credentials storage from the traditional application memory space to a separate dimensional space - the SSO credentials vault associated with a sandboxed user account. This dimensional separation allows the credentials to be securely stored outside the application's direct access scope while still enabling functional access through controlled injection mechanisms.
3Adaptability or versatility
If end users are allowed to debug or access application memory space, then application functionality and troubleshooting are improved, but SSO credential exposure increases
Solution Approach 1:
The patent applies local quality by giving different access rights to different parts of the system. The first user account has access rights to the application for normal operation and debugging, while the second user account holds the SSO credentials without allowing access to the application memory space. This localized differentiation of access rights allows debugging functionality while preventing credential exposure.
Data Source
AI summary
A technique includes creating, by a computer, a sandboxed user account on the computer, where creating the sandboxed user account includes generating credentials for the sandboxed user account. The technique includes creating, by the computer, an operating system session and executing a single sign on (SSO) tool in the operating system session in association with the sandboxed user account. In response to a request that is associated with another user account to start up an application, authorizing, by the computer, use of the application by the other user account based on credentials that are associated with the other user account and starting up the application by the computer. Starting up the application includes using the SSO tool to inject SSO credentials for the other user account based on policy authorization into the application such that the application is executed in association with the sandboxed user account.