Temporary Token Authentication for External Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for accessing VPN-protected resources through web browsers require users to repeatedly enter credentials for each external application, and the use of persistent cookies poses security risks due to potential malicious access.
Innovation Solution
Implementing a system that intercepts requests for network resources and issues temporary tokens with limited validity, allowing external applications to authenticate using these tokens, which are then replaced with actual credentials by the VPN gateway, thereby eliminating the need for repeated user input and enhancing security by avoiding insecure persistent cookies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If persistent cookies are used to share credentials across applications, then ease of operation is improved by avoiding repeated credential entry, but security deteriorates due to potential malicious access
Solution Approach 1:
The patent segments the credential storage mechanism into application-specific cookies rather than a shared persistent cookie. Each application has its own isolated cookie container, preventing malicious applications from accessing credentials of other applications while maintaining automated authentication across all applications.
Solution Approach 2:
The patent introduces an intermediary mechanism where the browser acts as a mediator between the user's credentials and the applications. The browser stores credentials securely and provides them to applications through a controlled interface, preventing direct access by malicious software while enabling automated authentication.
2Object-affected harmful factors
If users manually enter credentials for each external application, then security is improved by ensuring proper authentication, but ease of operation deteriorates due to repeated credential entry
Solution Approach 1:
The patent implements self-service authentication where the browser automatically retrieves and provides credentials to external applications without requiring manual user input. The system serves itself by automatically managing the authentication process across multiple applications, eliminating the need for repeated credential entry while maintaining security.
Solution Approach 2:
The patent performs preliminary action by having the user enter credentials once during initial browser authentication. The browser then stores these credentials and makes them available to subsequent applications, eliminating the need for repeated credential entry while maintaining proper authentication security.
3Object-affected harmful factors
If temporary tokens with limited validity are used, then security is improved by limiting credential exposure, but device complexity increases due to token management mechanisms
Solution Approach 1:
The patent employs temporary tokens with limited validity periods and usage counts, which are automatically invalidated after use or expiration. These disposable tokens provide enhanced security by limiting credential exposure risk while the browser automatically manages their lifecycle, minimizing the impact on system complexity.
Data Source
AI summary
In general, the invention is directed to techniques of automated authentication of network-enabled software applications launched by a web browser. For example, an intermediate device, such as a Virtual Private Network (VPN) gateway, intercepts communications between a client device and a server. The gateway device automatically issues a temporary token to the client device when the web browser requests a resource that will result in the launch of an additional software application external to the web browser. This temporary token is only valid for a limited time and a limited number of uses. Subsequently, the gateway device uses the temporary token to authenticate the second software application, thereby avoiding passing user credentials from the web browser to the second application on the client device via an insecure persistent cookie.