Trusted Third Party Client Authentication via SAML

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current video service provider systems face challenges in securely authenticating third-party devices and managing one-time account links for trusted third-party users, which affects the secure delivery of video content and services.

Innovation Solution

The implementation of an authentication architecture that utilizes security token services and SAML tokens to authenticate trusted third-party devices, coupled with a one-time account link management system, ensures secure access to video services by validating user credentials and establishing trusted status based on relationships with third-party entities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional authentication methods are used for third-party devices, then device access is granted, but security vulnerabilities and unauthorized access risks increase

Engineering Contradiction:

Improveauthentication securityVSAvoidunauthorized access risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a trusted third party entity as an intermediary that issues certificates of authenticity to third-party devices. This intermediary mechanism enables the video service provider to authenticate devices without directly managing all authentication logic, thereby improving security while maintaining system scalability and reducing unauthorized access risks.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary authentication by requiring third-party devices to present certificates of authenticity before accessing video content. This advance verification mechanism ensures that only authenticated devices can establish sessions with the video service provider, preventing unauthorized access before it can occur.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If comprehensive authentication protocols are implemented, then security is improved, but system complexity and implementation difficulty increase

Engineering Contradiction:

Improveauthentication securityVSAvoidauthentication system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The authentication system is segmented into distinct components: the trusted third party entity that issues certificates, the video service provider that validates certificates, and the third-party devices that present certificates. This segmentation allows each component to perform its specific function independently, reducing overall system complexity while maintaining comprehensive security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The certificate of authenticity mechanism serves multiple functions: it authenticates third-party devices, establishes trusted sessions, and enables secure content delivery. This multi-functional approach consolidates various authentication requirements into a single universal mechanism, reducing the need for multiple separate authentication systems.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If one-time account links are used for trusted users, then secure access is enabled, but account management complexity increases

Engineering Contradiction:

Improveaccount securityVSAvoidaccount management ease

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system employs one-time account links that are valid for a single authentication event and then become obsolete. These disposable link tokens provide strong security for trusted user access while simplifying account management, as each link is independently validated and automatically expires after use, eliminating the need for complex ongoing management.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

4Reliability

If third-party device authentication is implemented, then secure content delivery is improved, but processing time and authentication overhead increase

Engineering Contradiction:

Improvecontent delivery securityVSAvoidauthentication processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Third-party devices present certificates of authenticity in advance during the session establishment phase, before any video content is delivered. This preliminary authentication ensures that security verification is completed upfront, allowing subsequent content delivery to proceed without repeated authentication overhead, thereby minimizing processing time delays.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS9003189B2Trusted third party client authentication

Publication Date: 2015.04.07 VERIZON PATENT & LICENSING INC

AI summary

A method includes receiving, at a video service provider system, a request for an online video session from a third party device with a security markup assertion language (SAML) token as an input, decrypting a SAML assertion in the SAML token with a private key associated with the video service provider system, validating the SAML assertion based on a third party public key associated with the third party STS, and retrieving a third party account user identifier and a device type. The method also includes identifying a link time based on the third party account user identifier, identifying a password change time (PCT) stamp associated with the service provider user account, and providing the online video session to the third party device in response to determining that the PCT stamp is not later than the link time.