Abstract
This disclosure describes a technique for single sign-on across different protocols. A
device generates its own asymmetric key pair and authenticates once to an authority
under any first mechanism, such as a password, OAuth/OpenID Connect, Kerberos, SIM-
based AKA, a FIDO2 passkey, a smart card or a device certificate, while proving
possession of its private key. The authority issues a credential, signed by the authority,
that binds the subject and the first mechanism used to the device public key. No
symmetric key is shared with the device and no device identifier is assigned. To reach a
resource guarded by a different protocol (IMAP/SMTP, HTTP, RTSP/HLS/DASH, licence
servers, MQTT, CoAP, Matter, SSH, VPNs, Bluetooth/NFC, set-top boxes), the device signs
each request header together with the credential. The relying service verifies both
signatures, freshness, replay and revocation, using only the authority public key, so
validation also works offline. Renewal always moves to a new device key.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Boll, Joe, "Cross-Protocol Sign-On Using a Device-Held Key and an Authority-Signed, Key-Bound Credential", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/12736