Unified Session Authentication for Sub-Session Credential Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for computer systems require complex management of separate credentials for primary and sub-sessions, leading to increased computational overhead and complexity, which can degrade user experience due to improper termination of sub-sessions.
Innovation Solution
Deriving sub-session authentication credentials from primary session credentials, allowing for simplified management and synchronization, reducing the need for separate database entries and improving performance by tying sub-session validity to primary session validity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate authentication credentials are managed for primary and sub-sessions, then security is improved, but device complexity and computational overhead increase
Solution Approach 1:
The patent combines multiple authentication credentials (primary session credentials and sub-session credentials) into a single unified credential structure. The computer system now manages one set of authentication credentials that automatically applies to both the primary session and all sub-sessions, eliminating the need to separately store and manage multiple credential sets while maintaining security through the hierarchical session structure.
Solution Approach 2:
The authentication credentials are designed to serve multiple functions simultaneously. A single credential set is used for both primary session authentication and sub-session authentication, making the credential system universal across different session types. This multi-functionality reduces complexity while maintaining the security boundaries between different session levels.
2Reliability
If separate authentication credentials are managed for primary and sub-sessions, then security is improved, but productivity decreases due to increased computational overhead
Solution Approach 1:
By merging the authentication credential management into a single unified system, the patent eliminates redundant computational operations. Instead of separately validating and managing primary and sub-session credentials, the system performs a single authentication check that automatically applies to both session types, significantly reducing computational overhead and improving processing efficiency.
Solution Approach 2:
The patent implements preliminary authentication where the primary session credentials are validated first, and this validation result is then automatically inherited by sub-sessions. This preliminary action eliminates the need for repeated authentication checks for each sub-session, reducing computational overhead while maintaining security through the hierarchical credential inheritance structure.
3Reliability
If separate authentication credentials are managed for primary and sub-sessions, then security is improved, but ease of operation deteriorates due to improper termination of sub-sessions
Solution Approach 1:
The patent merges the session termination control into a unified mechanism where the primary session credentials and sub-session credentials are linked. When the primary session is terminated, the termination automatically propagates to all sub-sessions through the unified credential structure, ensuring consistent session management and eliminating the problems of improper or inconsistent sub-session termination that occurred with separate credential management.
Solution Approach 2:
The patent implements a feedback mechanism where the status of the primary session automatically feeds back to the sub-sessions through the unified credential system. When the primary session expires or is terminated, this status change is immediately reflected in the sub-session credentials, ensuring that sub-sessions are properly terminated without requiring separate management logic. This feedback loop maintains both security and operational simplicity.
Data Source
AI summary
A computer system receives a first request as part of a primary session with a client device to access information stored on a primary domain associated with the computer system. The first request includes an authentication key that was generated using a session key. The computer system receives a second request as part of a sub-session with the client device to access information stored on a secondary domain associated with the computer system. The second request includes a second authentication key that includes a session identifier of the primary session and a session payload generated using the session key and an indicator of the secondary domain. The computer system determines whether to grant the first and second requests using the first and second authentication keys, respectively.