Web Application Authentication via Intermediary Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for integrating web applications in industrial plants lack secure authentication mechanisms, particularly for controlling the execution of embedded web applications within surrounding ones, leading to potential security vulnerabilities and uncontrolled integration issues.
Innovation Solution
A method where a surrounding web application is authenticated with respect to an embedded web application using key material from a second web server, with authentication messages exchanged via the browser, ensuring secure authentication and authorization without transferring sensitive key material, and utilizing an iframe for secure encapsulation and communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If web applications are integrated using iframes and APIs without authentication mechanisms, then application integration and visual embedding are enabled, but security vulnerabilities and unauthorized access occur
Solution Approach 1:
The patent introduces an authentication message exchange mechanism as an intermediary between the surrounding web application and the embedded web application. The authentication server acts as a mediator that verifies the embedded application's identity and permissions before allowing integration, thus enabling secure application integration without compromising security
Solution Approach 2:
The patent implements preliminary authentication before the embedded web application is activated. The authentication messages are exchanged and verified in advance, ensuring that only authorized applications can be integrated. This preliminary security check prevents unauthorized access while still allowing legitimate integration
2Reliability
If authentication mechanisms are implemented between surrounding and embedded web applications, then security is improved, but system complexity increases
Solution Approach 1:
The patent implements a feedback mechanism where the embedded web application sends authentication responses back to the surrounding application through the authentication server. This structured feedback loop automates the verification process, reducing manual configuration complexity while maintaining security
Solution Approach 2:
The authentication mechanism is designed as a universal framework that can be applied to any embedded web application integration scenario. The same authentication message exchange protocol works across different applications and contexts, reducing the need for application-specific security configurations
Data Source
Figure 1
AI summary
The invention relates to a method and a system for authenticating a surrounding web application (AWA) by means of an embedded web application (AWB), wherein the surrounding first web application (AWA) is executed in a browser (B) and the embedded second web application (AWB) is provided for execution in a separate execution and display area (IF) of the surrounding first web application (AWA), wherein the surrounding first web application (AWA) is provided by at least one first web server (WSA), and the embedded second web application (AWB) is provided by at least one second web server (WSB).In this process, the surrounding first web application (AWA) is authenticated to the second web application (AWB) to be embedded. The first key material (SMA) assigned to the first web application (AWA) is usable by the second web server (WSB). Authentication messages are exchanged between the first web server (WSA) and the second web server (WSB) via the browser (B), and the second web application (AWB) is only activated upon successful authentication or authorization. This method allows the embedded web application to identify the surrounding web application and authenticate itself. A high level of security is ensured by storing and evaluating the necessary key material on the respective web server, because the key material itself is not transmitted, but only authentication messages for the local use of the key material.