Trustless SSO via Browser Extension Credential Manipulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Single Sign-On (SSO) authentication mechanisms are not feasible for systems that do not support backend integration or comply with privacy constraints, such as sensitive data systems like Electronic Health Records (EHR), leading to challenges in enabling users to access multiple software systems without re-entering credentials or relying on trust between systems.
Innovation Solution
A trustless SSO method that uses a software agent, like a browser extension, to monitor user interactions, extract and manipulate credentials, and log users into multiple systems without backend integration, ensuring privacy compliance by using one-way functions and user-specific salts to create unrecoverable credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional SSO authentication mechanisms are used, then users can access multiple software systems without re-entering credentials, but backend integration and trust between systems are required which violates privacy constraints in sensitive data systems
Solution Approach 1:
The patent introduces a browser extension as an intermediary component that operates locally in the user's browser without requiring backend integration between systems. The extension captures credentials during login to the first system, manipulates them locally using one-way functions, and automatically fills them in the second system, thereby mediating between the two systems while maintaining privacy constraints and avoiding direct trust relationships between backends.
Solution Approach 2:
The patent extracts the authentication functionality from the traditional backend-integrated SSO architecture and relocates it to the client-side browser extension. By taking out the credential manipulation process from the server environment and performing it locally in the user's browser, the system eliminates the need for backend integration while maintaining automatic login capabilities.
2Loss of time
If credentials are captured and manipulated automatically, then login process is streamlined and time-consuming manual entry is eliminated, but security risks increase if credentials are stored or transmitted
Solution Approach 1:
The patent transforms the credentials through parameter changes by applying one-way functions (such as hashing) to the captured credentials. This transformation modifies the credential data into an unusable form for attackers while preserving the ability to reconstruct valid credentials for the target system through the known manipulation process, thereby reducing security risks associated with storing or transmitting plain-text credentials.
Solution Approach 2:
The patent creates temporary manipulated credentials that exist only briefly during the login process. These credentials are generated on-demand, used immediately for automatic login, and then discarded. The use of disposable credential objects minimizes the window of exposure and reduces security risks compared to storing credentials for long-term use.
3Reliability
If one-way functions and salts are applied to credentials, then privacy and security are enhanced by making credentials unrecoverable, but the complexity of the authentication process increases
Solution Approach 1:
The patent implements self-service functionality within the browser extension that automatically performs credential capture, manipulation using one-way functions and salts, and automatic form filling. The extension handles the complex authentication process without requiring user intervention or awareness of the underlying cryptographic operations, thereby enhancing privacy protection while masking the complexity from the user.
Data Source
AI summary
A method, apparatus and product comprising: identifying a login session in a Graphical User Interface (GUI) of a user device, wherein the login session is configured to enable a user of the user device to login to a first software system; extracting one or more user credentials from the login session, wherein the one or more user credentials comprise one or more user inputs to the login session; manipulating the one or more user credentials using one or more manipulations, thereby obtaining manipulated credentials; and automatically utilizing the manipulated credentials in order to login the user into a second software system.