Single Sign-On Token Validation Using Internal Identity Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity provider-based authentication systems lack sufficient security, particularly for sensitive activities like banking, and managing multiple accounts is cumbersome and risky due to password reuse.
Innovation Solution
A method involving a service provider that verifies authentication tokens against internal configuration information not included in the token, creating a custom identity ID for secure user access management, and integrating with existing single-sign on systems to eliminate the need for storing user credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If identity provider-based authentication is used, then account management is simplified and password reuse is eliminated, but security is insufficient for sensitive activities like banking
Solution Approach 1:
The authentication process is segmented into multiple independent verification stages: (1) identity provider authentication, (2) service provider token validation against internal configuration, (3) additional security measures for sensitive activities. This segmentation allows each layer to address specific security concerns while maintaining overall system functionality.
Solution Approach 2:
The service provider performs preliminary validation of authentication tokens against internal configuration information before granting access. This preliminary action prevents unauthorized access by verifying token authenticity and matching user details against stored configuration data before the user can access protected resources.
2Adaptability or versatility
If multiple web service accounts are created, then access to different services is enabled, but tracking and managing all accounts becomes burdensome
Solution Approach 1:
The identity provider serves as a universal authentication mechanism that works across multiple web services. Users authenticate once with their identity provider credentials, and this authentication is then recognized by multiple service providers, eliminating the need to manage separate accounts and passwords for each service.
Solution Approach 2:
The identity provider acts as an intermediary between users and multiple service providers. It handles authentication and token generation, mediating the interaction between users and various services. This intermediary role simplifies account management by centralizing authentication functionality.
3Ease of manufacture
If password reuse across accounts occurs, then account creation is simplified, but security risk increases
Solution Approach 1:
The password management function is extracted from individual service providers and centralized in the identity provider. Users create and manage their passwords solely with the identity provider, which then issues authentication tokens to service providers. This extraction eliminates the security risk of password reuse while maintaining ease of account creation.
Solution Approach 2:
Instead of storing actual passwords at service providers, the system uses authentication tokens that copy the essential authentication information. The identity provider creates token copies that represent user authentication without exposing actual passwords, thereby eliminating security risks associated with password storage and reuse.
Data Source
AI summary
Described herein is a system, method, and non-transitory computer readable medium related to a service provider using a third party identity provider to authenticate a user with improved security. An authentication token is received from the identity provider, and can be verified against internal configuration information. The internal configuration information includes data that is not included in the authentication token, and therefore, is not vulnerable to some security attacks, such as a man-in-the-middle attack. After the authentication token is verified, the internal configuration information and authentication token may be used to create a custom identifier, referred to as an identity ID. The identity ID may be used by the service provider to verify user access to resources.