Token-Based Authentication for Multi-Device Account Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions fail to effectively prevent key exposure when multiple devices share the same account, leading to potential unauthorized access and loss for users.
Innovation Solution
An authentication method that generates token information based on a user's account, allowing devices within a group to authenticate and access the account without exposing the key, and automatically suspends login on the primary device when another device logs in, ensuring secure access and preventing conflicts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the same account and key are stored in multiple terminal devices for service access, then service accessibility is improved, but account security deteriorates due to key exposure risks
Solution Approach 1:
The authentication credentials are segmented into two distinct components: account information (stored on the server) and token information (stored on the terminal device). This segmentation allows the terminal to prove ownership without exposing the full account key, resolving the contradiction between accessibility and security.
Solution Approach 2:
Token information acts as an intermediary credential between the terminal device and the server. Instead of directly using the account key for authentication, the terminal uses the token as a mediator that proves ownership without exposing the actual key, thereby maintaining security while enabling access.
2Ease of operation
If account and key information is shared with another user's device for temporary use, then ease of operation is improved, but security risk increases due to key exposure
Solution Approach 1:
The critical security element (account key) is extracted from the terminal device and retained solely on the server. Only non-sensitive token information is stored on the terminal, allowing the user to safely share access with another device without exposing the actual key, thus enabling temporary sharing while maintaining security.
Solution Approach 2:
The token information functions as a disposable, short-lived credential that can be safely shared or transferred between devices. Unlike permanent account keys, these tokens can be revoked or replaced, providing a secure mechanism for temporary account sharing without long-term security risks.
3Adaptability or versatility
If multiple devices are authenticated with the same account key, then device versatility is improved, but security control deteriorates due to inability to revoke access
Solution Approach 1:
The authentication system transitions from a static model (where the same key is permanently stored on multiple devices) to a dynamic model (where the server can issue, revoke, and manage tokens on-demand). This allows flexible control over which devices have access at any given time, resolving the contradiction between multi-device support and access control.
Solution Approach 2:
The server maintains centralized control by receiving authentication requests from multiple devices, verifying their tokens, and providing feedback on whether access should be granted. This feedback mechanism enables the server to dynamically manage access rights across multiple devices, ensuring security control while supporting versatility.
Data Source
AI summary
The present disclosure discloses an authentication method performed at a server, including: generating, based on a first account that is possessed by a user of a first device and that corresponds to a first application, corresponding token information; sending the token information to the first device to be shared by the first device with devices in a device group in a replication restriction manner; performing, based on the token information, authentication on a second device that is in the device group; granting permission of accessing the first account to the second device when the authentication succeeds; and triggering the first device to switch from a state of first account-based login to the first application to a state of suspending the login to the first application when it is determined that the second device logs in to the first application based on the permission of accessing the first account.