USUID Token Authentication Across Services Without Personal Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods in electronic services face challenges such as direct transfer of personal information, increasing data leak risks, and third-party tracking via user IDs, especially in contexts where users interact with untrusted third-party services.
Innovation Solution
The generation of a User-Service Unique Identifier (USUID) based on user information and a Service Unique ID (SUID) using encryption and signature processes, packaged in a JSON Web Token (JWT), allows seamless authentication without prompting users for additional information, ensuring secure and efficient access across multiple services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a base web service system is used as a gate for authentication in side web service systems, then user authentication convenience is improved, but personal information security deteriorates due to direct transfer of user data to third-party services
Solution Approach 1:
The patent introduces an intermediary authentication mechanism where the base web service system generates a temporary authentication token (access token) that acts as a mediator between the user and the side web service system. This token contains encrypted user identification information and expiration time, allowing the side service to authenticate the user without directly receiving or storing the user's personal information. The token is validated by the base service system, which verifies its authenticity and checks if it has expired, thus protecting user data while enabling convenient cross-service authentication.
2Productivity
If user ID is shared across multiple web services for authentication, then authentication efficiency is improved, but user tracking and data leakage risks worsen
Solution Approach 1:
The patent segments the user identification information into multiple components: a permanent user ID stored securely in the base service system, and a temporary access token containing encrypted user identification and expiration information. The access token is divided into header (containing token type and expiration), payload (containing encrypted user ID and service ID), and signature (containing cryptographic verification data). This segmentation allows efficient authentication through token verification while preventing tracking because the token is service-specific and time-limited, cannot be reused across different services or after expiration, and the original user ID never leaves the base service system.
3Device complexity
If direct user credential sharing is implemented between base and side web service systems, then service integration simplicity is improved, but data leak risk increases
Solution Approach 1:
The patent creates a cryptographic copy of user authentication information in the form of an access token, which is a temporary, encrypted representation of the user's identity and authorization. Instead of sharing actual user credentials (usernames, passwords, personal information), the system generates this token copy that contains all necessary authentication data in encrypted form. The token includes the user ID, service ID, expiration time, and cryptographic signature. This copying approach simplifies service integration because the side service only needs to validate the token rather than implement complex authentication logic, while simultaneously reducing data leak risk because the token cannot be reverse-engineered to reveal the original credentials and expires automatically.
Data Source
AI summary
Method and system for authenticating a candidate user are disclosed. The method includes acquiring, by a second service from a first service, a request for a candidate User-Service Unique Identifier (USUID) associated with the candidate user. The candidate USUID is unique for a candidate user-first service pair. The method includes generating, by the second service, the candidate USUID, and sending a token indicative of the candidate USUID. In response to the candidate USUID matching a target USUID, the first service authenticates the candidate user as a target user without prompting the candidate user to provide additional information.