Token Sync Across Browser Instances for Enterprise SSO
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Single sign-on (SSO) technologies face limitations as non-browser applications, such as VPN clients, cannot share authentication ceremonies with other applications due to embedded browser constraints, preventing seamless access across different applications and devices.
Innovation Solution
Implementing a method to sync authentication and authorization tokens or cookies across different browser instances using enterprise-managed policies, allowing specific applications to share a common token or cookie store, and utilizing MDM/EMM ecosystems to manage and provision applications, ensuring secure and policy-driven sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each application uses its own embedded browser instance for SSO authentication, then each application can independently perform authentication ceremonies, but authentication cannot be shared across different applications requiring reauthentication
Solution Approach 1:
The patent merges multiple isolated browser instances into a unified authentication system by introducing a central token synchronization service. This service collects authentication tokens from one browser instance and distributes them to other instances, effectively combining the authentication capabilities across applications while maintaining the independence of each browser instance.
Solution Approach 2:
The patent introduces a token synchronization service as an intermediary between different browser instances. This mediator captures authentication tokens from the originating browser, stores them securely, and provides them to other browser instances that need to access the same enterprise applications, eliminating the need for reauthentication.
2Ease of operation
If authentication tokens are shared across multiple browser instances, then seamless access across applications is enabled, but security risks increase due to potential token exposure
Solution Approach 1:
The patent implements local quality by creating isolated storage environments for authentication tokens within each browser instance while maintaining centralized coordination. Each browser instance has its own secure storage context, and the token synchronization service operates at a different security level, ensuring that token exposure in one instance does not compromise others.
Solution Approach 2:
The token synchronization service acts as a secure intermediary that manages token distribution without exposing tokens directly between browser instances. It implements security policies, encrypts tokens during transmission and storage, and controls access based on application credentials, thereby enabling seamless access while mitigating security risks.
3Device complexity
If a centralized token store is implemented across all applications, then token sharing is simplified, but control over which applications can share tokens becomes difficult to manage
Solution Approach 1:
The patent implements dynamic control by making the token sharing configuration adjustable and policy-driven. Administrators can define which applications are authorized to share tokens, under what conditions, and the system dynamically enforces these policies. This allows flexible adaptation to different security requirements while maintaining a centralized management approach.
Solution Approach 2:
The patent segments the token sharing capability by application, creating isolated sharing contexts for each authorized application pair. Rather than a single monolithic token store, the system creates multiple controlled sharing environments, each with its own security policies and access rules, thereby simplifying management while maintaining granular control.
Data Source
AI summary
Techniques for syncing authentication and/or authorization tokens, cookies, and related metadata across different browser instances to enable disparate applications to share a single authentication/authorization ceremony. The techniques may include receiving a policy indicating multiple enterprise-managed applications that are capable of sharing tokens or cookies for user authentication. The techniques may also include receiving a token or a cookie indicating that a user is authenticated to access a first application of the multiple enterprise-managed applications. Based at least in part on the policy, the token or the cookie may be provided to a browser such that a second application of the multiple enterprise-managed applications refrains from causing the user to authenticate for access to the second application.