Decentralized Authentication Token Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Single Sign On (SSO) systems face challenges such as the difficulty in incorporating multiple service providers due to differing security systems, user inconvenience in accessing non-registered providers, security risks from storing multiple IDs and passwords, and high load on proxy servers.
Innovation Solution
Implementing a method where authentication is performed on a user's terminal with a client that stores and manages authentication information, including tokens and IDs/passwords, without relying on a proxy server, enabling secure and convenient access to multiple service providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a proxy server is used to store user IDs and passwords for Single Sign On, then user convenience is improved by allowing access to multiple websites without re-entering credentials, but security is worsened because user information is easily exposed if the proxy server is hacked
Solution Approach 1:
The patent segments the authentication system into multiple independent components: the user terminal stores authentication information locally rather than centrally in a proxy server, and the service provider verifies credentials directly. This segmentation eliminates the single point of failure (proxy server) that posed security risks, while maintaining the convenience of single sign-on through local credential storage and direct verification.
2Adaptability or versatility
If multiple service providers with different security systems are incorporated into an SSO system, then system versatility is improved, but device complexity is worsened due to the difficulty of making agreements between providers with different security systems
Solution Approach 1:
The patent implements a universal authentication approach where the user terminal stores authentication information that can be used across multiple service providers regardless of their individual security systems. The service provider directly verifies credentials from the terminal without requiring complex inter-provider agreements, enabling the system to work universally with any service provider while simplifying the overall architecture.
3Extent of automation
If authentication is performed through a proxy server, then centralized control is improved, but management costs and load on the proxy server increase
Solution Approach 1:
The patent extracts the authentication verification function from the proxy server and relocates it to the service provider. The proxy server's role is reduced to merely facilitating the initial authentication setup, while the actual verification burden is taken out and distributed to individual service providers. This extraction eliminates the heavy management load and costs associated with centralized proxy server authentication.
Data Source
AI summary
Method and apparatus for communication between client and service provider using external server, and a method and apparatus for controlling communication between a client and a service provider are provided. The method includes: receiving from the service provider a first authentication token indicating that the service provider has authenticated communication with the client by logging on the service provider; storing, in the external server, authentication information containing the first authentication token and additional information relating to communication with the service provider; receiving, when there is a request to access the service provider, authentication information corresponding to the request from the external server; and communicating with the service provider using the received authentication information. It is possible to alleviate the burden on a user to enter his or her ID and password, and to remove necessity for a user to enter the ID and password after registration has been performed once.