Token-Based Authentication for Mobile Service Platforms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile operators face challenges in establishing trust relationships with numerous third-party applications on Value-added services general operation platforms, leading to security concerns as user information is leaked during access flows, and existing authentication methods require manual intervention from users.
Innovation Solution
A method involving the generation and transmission of tokens to authenticate users and confirm access requests, allowing third-party applications to access user information while maintaining user privacy by not revealing usernames and passwords, and ensuring temporary authorization without direct user intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the third-party application directly accesses the mobile service platform using user account and password, then the access flow is simple, but the user account and password will be leaked to the third-party application
Solution Approach 1:
The patent introduces a token as an intermediary element between the user credentials and the third-party application. The mobile service platform generates a token that represents authorized access without exposing the actual user account and password. This token is then passed to the third-party application, allowing it to access user information without directly handling sensitive credentials, thus resolving the contradiction between simple access flow and information security.
2Reliability
If the mobile operators establish trust relationships with each third-party application one by one, then the security of user information is ensured, but the complexity of management increases significantly
Solution Approach 1:
The patent implements a universal token-based authentication mechanism that can be applied to any third-party application without requiring individual trust relationship setup. The mobile service platform provides a standardized interface that generates and validates tokens for multiple applications uniformly. This universal approach allows the system to maintain security across numerous third-party applications while avoiding the complexity of establishing and managing separate trust relationships for each application.
3Reliability
If manual authentication intervention is required from users, then the security control is tight, but the user experience deteriorates due to login burdens
Solution Approach 1:
The patent implements preliminary authentication where the user's identity is verified in advance by the mobile service platform before the third-party application needs access. The platform pre-generates tokens based on this preliminary authentication, allowing subsequent access operations to proceed without requiring repeated manual user intervention. This approach maintains tight security control through initial authentication while improving user experience by eliminating repetitive login burdens during subsequent access operations.
Data Source
AI summary
A method and apparatus for protecting user information. The method includes receiving a request for accessing the user information from an application. When the request does not include an authorized token, the user is requested to temporally confirm the request for access. In response to the confirmation, a token is generated and the user on a mobile service platform is associated with the request for access by the token. The application is then allowed to access the user information based on the token associating the user with the request for accessing the user information from the application.