SSO Session Management via Client-Side Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing access management systems face security and privacy concerns due to the use of cookies for maintaining user sessions, which can be accessed by third-party applications, and alternative methods like digital certificates require user installation and validation, leading to additional security risks.

Innovation Solution

An access management system that uses encryption keys generated by a client application to provide secure single sign-on (SSO) access to protected resources, eliminating the need for cookies or digital certificates by storing session information on the server and enabling the client application to encrypt and decrypt session identifiers using public and private keys.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If cookies are used to maintain user sessions, then session information can be stored and exchanged between the user device and access management system, but security and privacy concerns arise because third-party applications can access the stored cookie information

Engineering Contradiction:

Improvesession maintenanceVSAvoidsecurity risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the harmful session information (encrypted session identifiers) from client-side storage and relocates it to server-side storage in a secure data store. Only encrypted session identifiers are transmitted between client and server, while the actual session data remains protected on the server, eliminating the security vulnerability of client-side cookie storage.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces encrypted session identifiers as an intermediary mechanism. These encrypted identifiers serve as secure mediators that allow session verification without exposing actual session information to third-party applications. The encryption acts as a protective layer between the session data and potential unauthorized access.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If cookies are disabled or blocked to address security concerns, then third-party access to session information is prevented, but web applications cannot obtain user session information to provide SSO access to protected resources

Engineering Contradiction:

Improvesecurity riskVSAvoidSSO access

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The patent uses encrypted session identifiers as secure intermediaries that enable SSO functionality without requiring traditional cookies. These encrypted identifiers can be transmitted through web requests without being stored as accessible cookies, allowing session verification while maintaining security and compatibility with applications that block cookies.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical cookie storage system with an alternative approach using server-side stored encrypted session identifiers. Instead of relying on client-side cookie mechanisms, the system uses server-authenticated encrypted identifiers that can be verified without traditional cookie infrastructure.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If digital certificates are used for authentication, then secure access can be provided, but additional security risks arise due to the requirement for user installation and validation

Engineering Contradiction:

Improvesecure accessVSAvoidinstallation and validation

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the authentication complexity from the client side and consolidates it on the server side. Instead of requiring clients to manage digital certificates, the system uses encryption keys generated by the access management system itself, eliminating the need for user installation and validation of cryptographic materials.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The access management system generates and manages its own encryption keys and encrypted session identifiers without requiring external digital certificates. The system serves its own authentication needs through self-generated cryptographic materials, eliminating dependency on external certificate authorities and user-side certificate management.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS11750590B2Single sign-on (SSO) user techniques using client side encryption and decryption

Publication Date: 2023.09.05 ORACLE INT CORP

AI summary

An access management system (AMS) is disclosed that includes SSO capabilities for providing users secure access to protected resources within an enterprise using encryption keys generated by a client application. The AMS receives a request from a client application for a user to access a protected resource. In certain examples, the request comprises a client application identifier, a session identifier and a client public encryption key. The AMS determines if the session identifier points to a valid session and upon determining that the session identifier corresponds to a valid session, transmits information associated with the valid session to the client application. In certain examples, the information associated with the valid session is encrypted using the client public encryption key. Based on information associated with the valid session received from the client application, the AMS determines whether to grant or deny a user access to a protected resource within the enterprise.