Token-Based Authentication via Resource-Local Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods in computer systems require complex encryption and decryption processes, and rely on central authentication servers or operating system access, which can be cumbersome and vulnerable to eavesdropping when unencrypted communication channels are used.
Innovation Solution
A method that establishes an unauthenticated and unencrypted secondary communication channel between a client and server application, using an authentication token stored at a resource location, where only privileged users can access, allowing the server to authenticate the client by verifying the token's integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional encryption-based authentication is used, then security is improved, but device complexity and operational difficulty increase
Solution Approach 1:
The patent extracts the authentication token from the communication channel and stores it at a resource location (such as a file system or database). This separates the authentication mechanism from the communication protocol, allowing verification without complex encryption operations. The token is retrieved and verified independently, simplifying the authentication process while maintaining security.
Solution Approach 2:
The authentication token acts as an intermediary between the client application and the resource. Instead of directly verifying user credentials through complex encryption, the system uses this intermediate token stored at the resource location as a mediator for authentication. The client retrieves the token and presents it for verification, eliminating the need for real-time encryption/decryption operations.
2Ease of operation
If unencrypted communication channels are used, then ease of operation is improved, but security deteriorates due to eavesdropping vulnerability
Solution Approach 1:
The system performs preliminary authentication by storing the authentication token at the resource location before the client application needs to access resources. This preliminary action establishes security credentials in advance, allowing the client to retrieve and verify the token without requiring encrypted communication channels during the actual data transmission phase.
Solution Approach 2:
The patent uses a copy of the authentication token stored at the resource location as a substitute for secure transmission. Instead of transmitting encrypted credentials through the communication channel, the system retrieves a copy of the pre-stored token and verifies it. This copying approach maintains security while allowing unencrypted communication.
3Reliability
If central authentication servers are used, then authentication reliability is improved, but device complexity and operational difficulty increase
Solution Approach 1:
The client application performs self-authentication by retrieving the authentication token from the resource location and verifying it locally. This eliminates the need for a central authentication server, as the system uses its own stored credentials to verify client identity. The authentication process becomes self-contained, reducing architectural complexity while maintaining reliability.
Solution Approach 2:
The patent segments the authentication function from the communication channel and resource access. The authentication token is stored separately at the resource location, allowing independent verification. This segmentation separates authentication logic from the main system architecture, eliminating dependency on central servers and reducing overall system complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosure relates to authenticating a secondary communication channel (106) between a client application (101) and a server application (102) when an authenticated primary communication channel (104) has already been established between the client application and a resource application (103), on which the server application can store (124) a generated authentication token (143) that only privileged users including the client application user can read-access (127,128) and send back (129) to the server application by way of the secondary communication channel.