Single Sign-On Security Token Validation in Transaction Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing online transaction processing systems face challenges in establishing a robust trust relationship between service providers, requiring users to re-authenticate at each transaction server, which hinders seamless transaction processing across different services.
Innovation Solution
Implementing single sign-on (SSO) through the creation of read-only data objects from security tokens, such as SAML tokens, and transmitting them via secure transaction channels to transaction servers, allowing trusted access and sharing of validation attributes, thereby establishing a trusted relationship among transaction servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users authenticate at each transaction server individually, then each server can verify user credentials independently, but users must re-authenticate multiple times which reduces productivity and increases loss of time
Solution Approach 1:
The patent combines multiple authentication operations into a single authentication event. The identity provider authenticates the user once and generates a security token that is accepted by multiple transaction servers, merging what would otherwise be separate authentication operations into one unified process.
Solution Approach 2:
The identity provider performs authentication in advance and issues a security token before the user accesses transaction servers. This preliminary authentication action eliminates the need for repeated authentication at each server, as the token already contains verified credentials.
2Reliability
If security tokens are validated at every transaction server, then each server ensures security independently, but the system complexity increases due to multiple validation operations
Solution Approach 1:
The patent creates a copy of the validation result by embedding it in a security token issued by the identity provider. Transaction servers validate this token copy rather than performing independent validation operations, reducing system complexity while maintaining security.
Solution Approach 2:
The security token acts as an intermediary that carries validation attributes from the identity provider to transaction servers. This intermediary mechanism simplifies the system by replacing complex direct validation operations between servers and the identity provider with token-based verification.
3Reliability
If read-only data objects are transmitted via secure transaction channels, then data security is improved, but the transmission process requires additional infrastructure setup
Solution Approach 1:
The system establishes secure transaction channels automatically when needed, without requiring manual infrastructure setup for each transmission. The channel is created on-demand to transmit read-only data objects, making the security infrastructure self-managing and reducing overall complexity.
Data Source
AI summary
A single sign-on is implemented in an online transaction processing system. A security token extracted from a transaction request is received. The security token is validated and, in response to a positive validation, security information is extracted. The security information is processed to validate the transaction request and a set of validation attributes is generated. The set of validation attributes is stored in a read-only data object. A transaction server is notified of the read-only data object to authorize processing of the transaction request by the transaction server.