Token-Based Session Authentication Across Domains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for managing multiple authentication and authorization processes across different servers are complex, costly, and expose security risks due to the sharing of confidential user information and the need for multiple log-ins, disrupting the user experience and session continuity.
Innovation Solution
A method that uses a token created by one domain to facilitate seamless authentication and authorization across multiple domains, allowing users to maintain a single session without the need for repeated log-ins, by redirecting requests and using secure tokens and cookies to manage access and session validity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a central authentication service is used to implement single sign-on, then the user experience is improved by avoiding multiple log-ins, but the system complexity and deployment cost increase significantly
Solution Approach 1:
The patent introduces a security service as an intermediary component that mediates between the user agent and the web server. This security service handles authentication and authorization by validating security tokens, allowing the web server to access protected resources without requiring a central authentication service. The security token acts as a mediator carrying authentication information between domains.
Solution Approach 2:
The patent segments the authentication functionality into a separate security service component that can be independently deployed. Instead of requiring a monolithic central authentication service, the authentication logic is divided into the security service that validates tokens and the web server that enforces access control. This segmentation reduces overall system complexity while maintaining single sign-on capabilities.
2Ease of operation
If confidential user information is shared with a third party authentication service, then authentication is simplified, but security risks increase due to exposure of sensitive data
Solution Approach 1:
The patent extracts confidential user information from the authentication process. Instead of sharing sensitive user data with third-party services, the system uses security tokens that contain authentication information in an extracted and isolated form. The tokens can be validated without exposing the underlying confidential user information, thereby reducing security risks while maintaining simplified authentication.
Solution Approach 2:
The patent employs security tokens as temporary, disposable authentication carriers. These tokens are generated for specific authentication purposes and can be validated without revealing permanent confidential user information. The tokens act as short-lived substitutes for sensitive data, reducing the security risks associated with sharing confidential information while maintaining authentication functionality.
3Reliability
If multiple user names and passwords are required for different servers, then access control is maintained, but the user experience deteriorates due to session interruptions
Solution Approach 1:
The patent implements a universal security token that serves multiple authentication purposes across different web servers. Instead of requiring separate user names and passwords for each server, the single security token can be validated by multiple web servers that have access to the security service. This multi-functional approach maintains access control while eliminating the need for multiple credentials, thereby ensuring session continuity.
Solution Approach 2:
The patent performs preliminary authentication by generating and storing security tokens before the user needs to access protected resources. The security service pre-validates user credentials and creates tokens that can be used for subsequent access requests. This preliminary action eliminates the need for repeated authentication, maintaining security while ensuring uninterrupted session flow across multiple servers.
4Ease of operation
If user session is hosted by a third party service, then single log-on is achieved, but proprietary databases containing user information must be placed with the third party, increasing security risks
Solution Approach 1:
The patent introduces a security service as an intermediary that hosts security tokens rather than proprietary databases containing sensitive user information. The security service validates tokens without requiring access to confidential user data, thereby achieving single log-on functionality while keeping proprietary databases on-premises. This intermediary approach separates authentication validation from sensitive data storage, reducing security risks.
Solution Approach 2:
The patent extracts confidential user information from the authentication hosting function. Instead of placing proprietary databases with the third-party service, the system extracts only the necessary authentication validation capability into security tokens. The third-party security service hosts and validates these tokens without accessing or storing sensitive user information, achieving single log-on while maintaining data security.
Data Source
AI summary
Sharing of data between one domain and at least one other domain over a network is facilitated by the use of tokens. A user token set in a cookie stored on the user's system at log-on to a first domain is used to create, or is associated with, a secure token passed by a first domain to a second domain when the user, in a session with the second domain, requests resources, access to which includes authorization by a first domain. The secure token facilitates various actions pertinent to a user in a session with said second domain, including, for example, the maintenance of an active, concurrent session between a user and a first domain, and authentication and authorization without log-on at a second domain or other domains.