Step-Up Authentication Token Management for SSO Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems for mobile devices face challenges in providing convenient and secure access to sensitive resources, particularly in scenarios where native mobile applications cannot share authentication tokens and require repeated user credentials for step-up authentication, leading to user inconvenience and administrative complexities.
Innovation Solution
A method and system that utilize a token agent to manage primary and secondary tokens, allowing users to access resources with different authentication levels by generating a secondary token based on validated credentials, enabling single sign-on (SSO) and step-up authentication while maintaining secure access policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If token sharing is used for mobile SSO, then user convenience is improved by avoiding repeated credential entry, but security is worsened because the authentication service cannot revoke tokens for specific applications
Solution Approach 1:
The patent segments the authentication system by introducing application-specific tokens that are divided into multiple parts: a first token portion stored by the authentication service and a second token portion stored by the resource server. This segmentation enables selective revocation of specific application tokens without affecting other applications, resolving the security concern while maintaining SSO convenience.
Solution Approach 2:
The patent implements local quality by allowing different authentication levels and token types for different applications and resources. The authentication service can apply different security policies to different applications accessing the same resource server, enabling fine-grained control over token revocation and authentication requirements based on specific application needs.
2Reliability
If step-up authentication is implemented for sensitive resources, then security is improved by requiring additional verification, but user convenience is worsened by requiring repeated credential entry
Solution Approach 1:
The patent applies preliminary action by performing step-up authentication in advance before accessing sensitive resources. The authentication service validates additional credentials and generates authenticated token portions beforehand, so that when the resource server needs to access sensitive resources, the authentication is already completed, avoiding repeated credential entry while maintaining security.
Solution Approach 2:
The patent introduces the authentication service as an intermediary that manages step-up authentication. Instead of requiring users to directly re-enter credentials at the resource server, the authentication service mediates the process by validating credentials and generating appropriate token portions, simplifying the user experience while enforcing security requirements.
3Speed
If native applications store authentication tokens locally, then access speed is improved by avoiding repeated authentication, but adaptability is worsened because tokens cannot be shared across different applications
Solution Approach 1:
The patent implements universality by creating a token system that works across multiple applications and resource servers. The authenticated token portions can be shared between different native applications accessing the same resource server, enabling both fast local access and cross-application token sharing, thus achieving both speed and adaptability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for authenticating a user seeking access to first and second resources that have different authentication levels. The method includes receiving a primary token that is associated with a first authentication event of the user and authenticates the user to access the first resource, and receiving a first request to access the second resource. The method further includes receiving first credentials of the user. The method further includes, responsive to validating the first credentials, generating a second authentication event, associating the second authentication event with the primary token, and issuing a first secondary token that authenticates the user to access the second resource.