Token Push Authentication for Mobile Enterprise Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Typical enterprise applications require users to enter username and password when accessed from mobile devices, which is cumbersome, error-prone, and time-consuming, and does not provide sufficient authentication, increasing the risk of malicious requests and denial-of-service attacks.
Innovation Solution
A method where a mobile communication device requests a token by sending its device identifier and email address to an Intermediate Application Gateway (IAG), which validates and pushes the token to the device, allowing subsequent application data to identify the user, thereby eliminating the need for username and password entry and reducing the risk of unsolicited token responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If username and password entry is required for mobile device access, then authentication security is maintained through credential verification, but ease of operation deteriorates due to cumbersome and error-prone manual entry
Solution Approach 1:
The patent extracts the authentication credentials (username and password) from the access process entirely. Instead of requiring users to enter credentials, the system pushes tokens directly to authorized mobile devices, eliminating the manual entry step while maintaining security through device-specific token delivery
Solution Approach 2:
The system implements self-service authentication where the mobile device automatically receives and stores tokens without user intervention. The device identifier itself serves as the authentication mechanism, eliminating the need for users to manually input credentials or remember passwords
2Ease of operation
If username and password entry is required, then authentication process is straightforward, but productivity deteriorates due to time-consuming access procedures
Solution Approach 1:
The system performs preliminary authentication by pushing tokens to mobile devices in advance, before actual access is needed. Tokens are delivered proactively to authorized devices, so when users need to access enterprise resources, authentication has already been completed, eliminating wait time
Solution Approach 2:
The automatic token delivery and device-based authentication eliminates manual entry steps entirely. The system serves itself by automatically managing token distribution to authorized devices, making the process both simple and fast without requiring user interaction
3Ease of operation
If traditional authentication is used without sufficient verification, then ease of operation is maintained, but reliability deteriorates due to increased risk of malicious requests and denial-of-service attacks
Solution Approach 1:
The patent introduces an intermediary authentication mechanism using device identifiers and pushed tokens. Instead of relying on user-provided credentials that can be guessed or stolen, the system uses a trusted intermediary (the mobile device itself with its unique identifier) to verify authenticity, making it resistant to malicious requests and attacks
Solution Approach 2:
The mobile device serves as its own authentication credential through its unique device identifier. This self-identifying mechanism eliminates the need for separate usernames and passwords, maintaining simplicity while dramatically improving security against attacks since the device identifier is inherently tied to the specific authorized device
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Providing access to an enterprise application from a telecommunications device via a client, through a device server, and an intermediate application gateway (IAG), is disclosed. The server is communication with the client and the IAG. The IAG and client are in indirect communication via the server. The client is operative to request an enterprise application token from the IAG using a dataset comprising a device identifier and a user identifier, without concurrently prompting a user for the dataset. The IAG is operative to prepare a token in response to the request, and push the token to an e-mail address associated with the telecommunications device via the server's push proxy gateway. The client is operative to employ the token in communications addressed to an enterprise application via the server and the IAG. The IAG is operative to replace the token in each communication with identification information called for by the enterprise application.