Patent Description:
Regarding the use of one service account, account information is not shared between a device and a browser in a way of transmitting account information stored in the device to the browser or transmitting account information input via the browser to the device, because having a device and a browser communicate with each other in these ways is difficult.

When a user who has already logged in to a device with an account is trying to log in with the same account information through a browser, they need to enter the same account information, such as an identification (ID) or password, again through the browser, because it is currently not possible for a device and a browser to share account information with each other directly. <CIT> relates to a system, server, terminal and tamper resistant device for authenticating a user. <CIT> relates to a system and method for an authentication process of a Java client agent by applet and remote method invocation.

When a user logs in to a device and a browser respectively, the user may experience inconvenience because the user may be asked to repeat the same process. When the user forgets an ID or password of an account the device is logged in to, the user may also experience inconvenience. These inconveniences may encourage the user to stop using a service.

Whenever account information stored in a device is transmitted to a browser, a local host for transmitting account information from a device to a browser runs. The local host may become an attack point of a static network, and thus may be a security vulnerability and can increase battery consumption of the device. If a one time token (OTP) is used to log in via a malicious browser or web page that may be forged or manipulated and is extorted on a network, account information may be exposed.

According to various example embodiments described herein, a method of providing login information involving transmitting login information of a user logged in to an electronic device may be provided and an electronic device performing the method may be provided.

According to various example embodiments described herein, a method of providing login information which may involve performing hypertext transfer protocol (HTTP) communication, generating a random number value in an electronic device, and validating a browser, an authentication web server, a random number value, a user authentication token, and a timestamp may be provided, and an electronic device performing the method may be provided. Accordingly, login information transmitted by the method may be more secure and less likely to be extorted by an external network.

According to an aspect of the disclosure, a method of providing login information may include sending, from a service web page executed on a browser, a login request to an authentication web page executed on the browser. The method may include executing, by the authentication web page, a single sign on (SSO) agent in an electronic device. The method may include sending, by the authentication web page, a request for authentication information of a user to the SSO agent. The method may include sending, by the authentication web page, a request for a random number to the SSO agent. The method may include generating, by the SSO agent, a random number and transmitting the random number to the authentication web page. The method may include generating an encrypted eigenvalue on an authentication web server based on the random number and transmitting the eigenvalue to the SSO agent. The method may include calling, by the SSO agent, an authentication application programming interface (API) server, and transmitting the eigenvalue. The method may include validating the eigenvalue on the authentication API server, and receiving, by the SSO agent, a result of the validating from the authentication API server. The method may include transmitting the authentication information to the authentication web server.

According to an aspect of the disclosure, an electronic device may include at least one processor, and a memory configured to store instructions executed by the at least one processor, a browser, and an SSO agent. The browser may be configured to access a service web server and an authentication web server to execute a service web page and an authentication web page. The SSO agent may be configured to log in to the electronic device and/or the service web server. The at least one processor may be configured to, in response to the instructions being executed by the at least one processor, send, from the service web page executed on the browser, a login request to the authentication web page executed on the browser. The at least one processor may be configured to cause the authentication web page to execute the SSO agent, and to send a request for authentication information of a user to the SSO agent. The at least one processor may be configured to cause the SSO agent to generate a random number and transmit the random number to the authentication web page. The at least one processor may be configured to call an authentication API server to transmit an eigenvalue received from an authentication web server, and to receive a validation result of the eigenvalue from the authentication API server. The at least one processor may be configured to transmit the authentication information to the authentication web server.

According to an aspect of the disclosure, a non-transitory computer readable medium may store computer readable program code or instructions for carrying out operations, when executed by a processor, for providing login information.

The operations may include accessing a service web server and an authentication web server, by an electronic device via a browser stored on the electronic device, to execute a service web page from the service web server and an authentication web page from the authentication web server. The operations may include accessing the executed service web page, by the electronic device via the browser, to cause the service web server to send a login request to the authentication web server. The operations may include receiving one or more instructions from the authentication web server, by the electronic device, in response to causing the service web server to send the login request to the authentication web server, to execute a single sign on (SSO) agent of the electronic device. The operations may include receiving a request for authentication information from the authentication web server, by the electronic device via the SSO agent. The operations may include generating a random number, by the electronic device via the SSO agent, in response to receiving the request for authentication information. The operations may include sending the random number to the authentication web server, by the electronic device via the SSO agent. The operations may include receiving an eigenvalue generated on the authentication web server, by the electronic device via the SSO agent, wherein the eigenvalue is generated based at least in part on the random number. The operations may include sending a request to authenticate the eigenvalue, by the electronic device via the SSO agent, to an authentication application programming interface (API) server. The operations may include receiving an authentication result corresponding to the eigenvalue, by the electronic device via the SSO agent, from the authentication API server in response to sending the request to authenticate the eigenvalue. The operations may include sending authentication information to the authentication web server, by the electronic device via the SSO agent, based at least in part on the authentication result, the authentication information corresponding to the login request sent by the service web server, and wherein the authentication information is used by the authentication web server to respond to the login request from the service web server.

The operations may further include executing a local host web server, by the electronic device via the SSO agent, in response to the authentication web server executing the SSO agent, and verifying the browser and the authentication web page, by the electronic device via the SSO agent, in response to receiving the request for authentication information from the authentication web server.

The operations may further include outputting a notification, by the electronic device via the SSO agent, in response to sending the authentication information to the authentication web server, the notification indicating that a logging in of a user to a service provided by the service web server is complete.

The operations may further include terminating the local host web server, by the electronic device via the SSO agent, and terminating the SSO agent, by the electronic device via the SSO agent.

According to various example embodiments described herein, it may be possible to transmit authentication information of a user logged in an electronic device, and to log in to a web server where a user may receive service.

According to various example embodiments described herein, HTTP communication performed in an electronic device may decrease a risk of extortion by an external network, and it may be possible to enhance security of user account information by transmitting a generated random number value only to an authentication web server and validating a browser and the authentication web server.

According to various example embodiments described herein, it may be possible to validate a random number value and a timestamp of an eigenvalue decrypted by an authentication API server to prevent a duplicate login request with the same random number value and to determine whether the timestamp falls within a valid period range.

Hereinafter, example embodiments will be described in detail with reference to the accompanying drawings. When describing the example embodiments with reference to the accompanying drawings, like reference numerals refer to like elements and any repeated description related thereto will be omitted.

<FIG> is a block diagram illustrating an electronic device <NUM> in a network environment <NUM> according to various example embodiments. Referring to <FIG>, the electronic device <NUM> in the network environment <NUM> may communicate with an electronic device <NUM> via a first network <NUM> (e.g., a short-range wireless communication network), or communicate with at least one of an electronic device <NUM> or a server <NUM> via a second network <NUM> (e.g., a long-range wireless communication network). According to an example embodiment, the electronic device <NUM> may communicate with the electronic device <NUM> via the server <NUM>. According to an example embodiment, the electronic device <NUM> may include a processor <NUM>, a memory <NUM>, an input module <NUM>, a sound output module <NUM>, a display module <NUM>, an audio module <NUM>, and a sensor module <NUM>, an interface <NUM>, a connecting terminal <NUM>, a haptic module <NUM>, a camera module <NUM>, a power management module <NUM>, a battery <NUM>, a communication module <NUM>, a subscriber identification module (SIM) <NUM>, or an antenna module <NUM>. In some example embodiments, at least one of the components (e.g., the connecting terminal <NUM>) may be omitted from the electronic device <NUM>, or one or more other components may be added to the electronic device <NUM>. In some example embodiments, some of the components (e.g., the sensor module <NUM>, the camera module <NUM>, or the antenna module <NUM>) may be integrated as a single component (e.g., the display module <NUM>).

The processor <NUM> may execute, for example, software (e.g., a program <NUM>) to control at least one other component (e.g., a hardware or software component) of the electronic device <NUM> connected to the processor <NUM>, and may perform various data processing or computation. According to an example embodiment, as at least a part of data processing or computation, the processor <NUM> may store a command or data received from another component (e.g., the sensor module <NUM> or the communication module <NUM>) in a volatile memory <NUM>, process the command or the data stored in the volatile memory <NUM>, and store resulting data in a non-volatile memory <NUM>. According to an example embodiment, the processor <NUM> may include a main processor <NUM> (e.g., a central processing unit (CPU) or an application processor (AP)), or an auxiliary processor <NUM> (e.g., a graphics processing unit (GPU), a neural processing unit (NPU), an image signal processor (ISP), a sensor hub processor, or a communication processor (CP)) that is operable independently from, or in conjunction with the main processor <NUM>. For example, when the electronic device <NUM> includes the main processor <NUM> and the auxiliary processor <NUM>, the auxiliary processor <NUM> may be adapted to consume less power than the main processor <NUM> or to be specific to a specified function. The auxiliary processor <NUM> may be implemented separately from the main processor <NUM> or as a part of the main processor <NUM>.

The auxiliary processor <NUM> may control at least some of functions or states related to at least one (e.g., the display module <NUM>, the sensor module <NUM>, or the communication module <NUM>) of the components of the electronic device <NUM>, instead of the main processor <NUM> while the main processor <NUM> is in an inactive (e.g., sleep) state or along with the main processor <NUM> while the main processor <NUM> is an active state (e.g., executing an application). According to an example embodiment, the auxiliary processor <NUM> (e.g., an ISP or a CP) may be implemented as a part of another component (e.g., the camera module <NUM> or the communication module <NUM>) that is functionally related to the auxiliary processor <NUM>. According to an example embodiment, the auxiliary processor <NUM> (e.g., an NPU) may include a hardware structure specified for artificial intelligence (AI) model processing. Such learning may be performed by, for example, the electronic device <NUM> in which artificial intelligence is performed, or performed via a separate server (e.g., the server <NUM>). Learning algorithms may include, but are not limited to, for example, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning. The AI model may include a plurality of artificial neural network layers. An artificial neural network may include, for example, a deep neural network (DNN), a convolutional neural network (CNN), a recurrent neural network (RNN), a restricted Boltzmann machine (RBM), a deep belief network (DBN), and a bidirectional recurrent deep neural network (BRDNN), a deep Q-network, or a combination of two or more thereof, but examples of which are not limited thereto. The AI model may additionally or alternatively include a software structure other than the hardware structure.

The program <NUM> may be stored as software in the memory <NUM>, and may include, for example, an operating system (OS) <NUM>, middleware <NUM>, or an application <NUM>.

The input module <NUM> may receive a command or data to be used by another component (e.g., the processor <NUM>) of the electronic device <NUM>, from outside of the electronic device <NUM> (e.g., from a user).

The sound output module <NUM> may output a sound signal outside of the electronic device <NUM>. The speaker may be used for general purposes, such as playing multimedia or playing recordings. The receiver may be used to receive an incoming call. According to an example embodiment, the receiver may be implemented separately from the speaker or as a part of the speaker.

The display module <NUM> may visually provide information to the outside of the electronic device <NUM> (e.g., to a user). The display module <NUM> may include, for example, a display, a hologram device, or a projector, and control circuitry to control a corresponding one of the display, the hologram device, and the projector. According to an example embodiment, the display module <NUM> may include a touch sensor adapted to detect a touch, or a pressure sensor adapted to measure the intensity of force incurred by the touch.

The audio module <NUM> may convert a sound into an electric signal or vice versa. According to an example embodiment, the audio module <NUM> may obtain the sound via the input module <NUM> or output the sound via the sound output module <NUM> or an external electronic device (e.g., the electronic device <NUM> such as a speaker or headphones) directly or wirelessly connected to the electronic device <NUM>.

The sensor module <NUM> may detect an operational state (e.g., power or temperature) of the electronic device <NUM> or an environmental state external to the electronic device <NUM> (e.g., a state of a user), and generate an electric signal or data value corresponding to the detected state. According to an example embodiment, the sensor module <NUM> may include, for example, a gesture sensor, a gyro sensor, an atmospheric pressure sensor, a magnetic sensor, an acceleration sensor, a grip sensor, a proximity sensor, a color sensor, an infrared (IR) sensor, a biometric sensor, a temperature sensor, a humidity sensor, or an illuminance sensor.

The interface <NUM> may support one or more specified protocols to be used for the electronic device <NUM> to be coupled with the external electronic device (e.g., the electronic device <NUM>) directly (e.g., wired) or wirelessly. According to an example embodiment, the interface <NUM> may include, for example, a high-definition multimedia interface (HDMI), a universal serial bus (USB) interface, a secure digital (SD) card interface, or an audio interface.

The connecting terminal <NUM> may include a connector via which the electronic device <NUM> may be physically connected to an external electronic device (e.g., the electronic device <NUM>). According to an example embodiment, the connecting terminal <NUM> may include, for example, an HDMI connector, a USB connector, an SD card connector, or an audio connector (e.g., a headphone connector).

The haptic module <NUM> may convert an electric signal into a mechanical stimulus (e.g., a vibration or a movement) or an electrical stimulus which may be recognized by a user via his or her tactile sensation or kinesthetic sensation. According to an example embodiment, the haptic module <NUM> may include, for example, a motor, a piezoelectric element, or an electric stimulator.

The camera module <NUM> may capture a still image and moving images. According to an example embodiment, the camera module <NUM> may include one or more lenses, image sensors, image signal processors, or flashes.

According to an example embodiment, the power management module <NUM> may be implemented as, for example, a part of a power management integrated circuit (PMIC).

For example, if the electronic device <NUM> is not connected to an external power source that can supply power to the at least one component, then the battery <NUM> may supply power to the at least one component of the electronic device <NUM>. According to an example embodiment, the battery <NUM> may include, for example, a primary cell which is not rechargeable, a secondary cell which is rechargeable, or a fuel cell.

The communication module <NUM> may include one or more communication processors that are operable independently of the processor <NUM> (e.g., an AP) and that support a direct (e.g., wired) communication or a wireless communication. According to an example embodiment, the communication module <NUM> may include a wireless communication module <NUM> (e.g., a cellular communication module, a short-range wireless communication module, or a global navigation satellite system (GNSS) communication module) or a wired communication module <NUM> (e.g., a local area network (LAN) communication module, or a power line communication (PLC) module). A corresponding one of these communication modules may communicate with the external electronic device <NUM> via the first network <NUM> (e.g., a short-range communication network, such as Bluetooth™, wireless-fidelity (Wi-Fi) direct, or infrared data association (IrDA)) or the second network <NUM> (e.g., a long-range communication network, such as a legacy cellular network, a <NUM> network, a next-generation communication network, the Internet, or a computer network (e.g., a LAN or a wide area network (WAN)). The wireless communication module <NUM> may identify and authenticate the electronic device <NUM> in a communication network, such as the first network <NUM> or the second network <NUM>, using subscriber information (e.g., international mobile subscriber identity (IMSI)) stored in the SIM <NUM>.

The wireless communication module <NUM> may support a <NUM> network after a <NUM> network, and a next-generation communication technology, e.g., a new radio (NR) access technology. The wireless communication module <NUM> may support a high-frequency band (e.g., a mmWave band) to achieve, e.g., a high data transmission rate. The wireless communication module <NUM> may support various technologies for securing performance on a high-frequency band, such as, e.g., beamforming, massive multiple-input and multiple-output (MIMO), full dimensional MIMO (FD-MIMO), an array antenna, analog beam-forming, or a large scale antenna. According to an example embodiment, the wireless communication module <NUM> may support a peak data rate (e.g., <NUM> Gbps or more) for implementing eMBB, loss coverage (e.g., <NUM> dB or less) for implementing mMTC, or U-plane latency (e.g., <NUM> or less for each of downlink (DL) and uplink (UL), or a round trip of <NUM> or less) for implementing URLLC.

The antenna module <NUM> may transmit a signal or power to outside of the electronic device <NUM> (e.g., to the external electronic device <NUM>), or receive a signal or power from outside of the electronic device <NUM> (e.g., from the external electronic device <NUM>). According to an example embodiment, the antenna module <NUM> may include an antenna including a radiating element including a conductive material or a conductive pattern formed in or on a substrate (e.g., a printed circuit board (PCB)). According to an example embodiment, the antenna module <NUM> may include a plurality of antennas (e.g., array antennas). In such a case, at least one antenna appropriate for a communication scheme used in a communication network, such as the first network <NUM> or the second network <NUM>, may be selected by, for example, the communication module <NUM> from the plurality of antennas. The signal or the power may be transmitted or received between the communication module <NUM> and the external electronic device via the at least one selected antenna. According to an example embodiment, another component (e.g., a radio frequency integrated circuit (RFIC)) other than the radiating element may be additionally formed as a part of the antenna module <NUM>.

According to various example embodiments, the antenna module <NUM> may include a mmWave antenna module. The mmWave antenna module may include, for example, a printed circuit board, an RFIC disposed on a first surface (e.g., the bottom surface) of the printed circuit board, or adjacent to the first surface and capable of supporting a designated high-frequency band (e.g., the mmWave band), and a plurality of antennas (e.g., array antennas) disposed on a second surface (e.g., the top or a side surface) of the printed circuit board, or adjacent to the second surface and capable of transmitting or receiving signals of the designated high-frequency band.

At least some of the above-described components may be mutually coupled and communicate signals (e.g., commands or data) there between via an inter-peripheral communication scheme (e.g., a bus, general purpose input and output (GPIO), serial peripheral interface (SPI), or mobile industry processor interface (MIPI)).

According to an example embodiment, commands or data may be transmitted or received between the electronic device <NUM> and the external electronic device <NUM> via the server <NUM> coupled with the second network <NUM>. Each of the external electronic devices <NUM> or <NUM> may be a device of the same type as or a different type from the electronic device <NUM>. According to an example embodiment, all or some of operations to be executed by the electronic device <NUM> may be executed at one or more external electronic devices (e.g., the external devices <NUM> and <NUM>, and the server <NUM>). For example, if the electronic device <NUM> needs to perform a function or a service automatically, or in response to a request from a user or another device, the electronic device <NUM>, instead of, or in addition to, executing the function or the service, may request the one or more external electronic devices to perform at least part of the function or the service. The one or more external electronic devices receiving the request may perform the at least part of the function or the service requested, or an additional function or an additional service related to the request, and may transfer an outcome of the performing to the electronic device <NUM>. In an example embodiment, the external electronic device <NUM> may include an Internet-of-things (IoT) device. According to an example embodiment, the external electronic device <NUM> or the server <NUM> may be included in the second network <NUM>.

<FIG> is a diagram illustrating a method of logging in to an electronic device according to various example embodiments. The logging in can include, for example, an operation in which a user logs in to an electronic device (e.g., the electronic device <NUM>).

Referring to <FIG>, the electronic device may log in to an account application using input account information. In some implementations, the account application may be referred to as a single sign on (SSO) agent. As illustrated in (a) OF <FIG>, an identifier, such as an icon <NUM>, for executing an "A" account application corresponding to the account application of the electronic device may be displayed on a display module. The electronic device may execute the "A" account application by receiving, from a user, an input to execute the "A" account application (e.g., an input selecting the icon <NUM>).

As illustrated in (b) OF <FIG>, in response to the account application of the electronic device being executed by the user, the electronic device may provide a screen for inputting account information of the user, such as an identification (ID) and a password. In some implementations, the electronic device may receive account information from the user, and the SSO agent may log in with an account of the user using the received account information.

As illustrated in (c) OF <FIG>, information on a logged-in account of a user may be displayed on the display module of the electronic device.

<FIG> is a diagram illustrating a method of transmitting account information to a browser according to various example embodiments. The transmitting of the account information can include, for example, an operation in which an electronic device (e.g., the electronic device <NUM>) transmits the account information to the browser.

Referring to <FIG>, the electronic device may transmit account information of a user account logged in to the electronic device to the browser. In some implementations, the account information of the user account logged in to the electronic device may be account information of a user logged in to an SSO agent.

(a) OF <FIG> illustrates a service web page (e.g., a login page) executed on the browser of the electronic device and displayed on a display module by the electronic device to receive a login request from a user. In some implementations, the service web page may be executed on a browser using data, such as a code and instructions received from a service web server that a user accesses to use a service. In some implementations, the service web page may be a web page received from the service web server.

As illustrated in (b) OF <FIG>, in response to receiving an input to log in to the service web server using authentication information of a logged-in user, the electronic device may log in to the service web server. For example, in response to a user selecting "Log in with Galaxy device" shown in (a) OF <FIG>, the electronic device may automatically log in to the service web server using authentication information of the user logged in to an SSO agent.

As another example, in response to the user selecting "Log in with your ID" shown in (a) OF <FIG>, the electronic device may display a user interface screen for inputting information to log in to an account of the user, such as an ID and a password of the user. The information used to log in to the account of the user may include biometric authentication information, such as fingerprint recognition and iris recognition information.

In some implementations, in response to a login request being received from the user via the service web page of (a) OF <FIG>, the authentication web page may be executed on the browser. In some implementations, the authentication web page may be executed on the browser using data, such as a code and instructions received from the authentication web server.

In some implementations, the electronic device may display a login screen (substantially the same as the service web page illustrated in (a) OF <FIG>) using an authentication web page received from an authentication web server and executed on a browser.

In some implementations, the electronic device may automatically log in to the service web server without additionally inputting an ID and a password using authentication information of the user logged in to the electronic device.

<FIG> is a schematic block diagram illustrating a network environment of an electronic device according to various example embodiments. As illustrated in <FIG>, the network environment may include the electronic device <NUM>, a service web server <NUM>, an authentication web server <NUM>, and an authentication API server <NUM>.

The electronic device <NUM> may be connected and in communication with the service web server <NUM>, the authentication web server <NUM>, and the authentication API server <NUM> through, for example, the second network <NUM>. In some implementations, the electronic device <NUM> may transmit authentication information <NUM> of a user stored in the SSO agent <NUM> of the electronic device <NUM> to a browser <NUM> by communicating with the user service web server <NUM>, the authentication web server <NUM>, and the authentication API server <NUM>.

Referring to <FIG>, the memory <NUM> of the electronic device <NUM> may include the browser <NUM> and the SSO agent <NUM>. For example, the browser <NUM> and the SSO agent <NUM> may be stored in the memory <NUM>. A processor (e.g., the processor <NUM>) of the electronic device <NUM> may execute the browser <NUM> and the SSO agent <NUM> stored in the memory <NUM>.

In some implementations, the browser <NUM> may execute a service web page <NUM> and an authentication web page <NUM>. The service web page <NUM> and the authentication web page <NUM> may be results of executing, on the browser <NUM>, messages received from the service web server <NUM> and the authentication web server <NUM> respectively. For example, the browser <NUM> may receive a web page from the service web server <NUM> and/or the authentication web server <NUM>, and in response to the received web page being executed, the service web page <NUM> and/or the authentication web page <NUM> may be executed on the browser <NUM>.

In some implementations, the service web page <NUM> may be a web page to send a request for authentication executed on the browser <NUM> using the message received from the service web server <NUM>. The service web page <NUM> may be executed on the browser <NUM> using data, such as a code and instructions received from the user service web server <NUM>. In some implementations, the authentication web page <NUM> may be a web page to send a request for authentication executed on the browser <NUM> using the message received from the authentication web server <NUM>. The authentication web page <NUM> may be executed on the browser <NUM> using data, such as a code and instructions received from the authentication web server <NUM>.

In some implementations, the SSO agent <NUM> may be an account application. In some implementations, the SSO agent <NUM> may generate and execute a local host web server <NUM> by receiving a request from the authentication web server <NUM>. In some implementations, the SSO agent <NUM> may store login authentication information <NUM> of a user input to the electronic device <NUM>. In some implementations, the login authentication information <NUM> of the user may be a user authentication token issued in response to a login being performed with user account information.

In some implementations, the local host web server <NUM> may correspond to a communication channel for communication with the authentication web server <NUM> and/or the authentication API server <NUM>. In some implementations, in response to being executed by the SSO agent <NUM>, the local host web server <NUM> may perform communication with the authentication web server <NUM>.

In some implementations, in response to authentication being completed, the SSO agent <NUM> may transmit account information of a user stored in the SSO agent <NUM> of the electronic device <NUM> to the browser <NUM> and then terminate the local host web server <NUM>. In some implementations, the SSO agent <NUM> may terminate the local host web server <NUM> and then terminate itself. By terminating the local host web server <NUM>, it may be possible to prevent malicious attacks on the electronic device <NUM> and reduce battery consumption of the electronic device <NUM>.

According to various example embodiments, the service web server <NUM> may be a web server that users access to use a service. In response to logging in to the service web server <NUM> with an account of a user, the electronic device <NUM> may receive a service from the service web server <NUM>.

The authentication web server <NUM> may receive a login request from the service web server <NUM>. For example, the authentication web server <NUM> may provide data to log in to the electronic device <NUM> by receiving the login request. In some implementations, the authentication web server <NUM> may perform an authentication process.

According to various example embodiments, the authentication web server <NUM> may generate an asymmetric key (e.g., a public key and a private key) in an encryption module <NUM>. In some implementations, the authentication web server <NUM> may transmit a public key <NUM> to the authentication API server <NUM>. In some implementations, the asymmetric key may be generated according to a Rivest-Shamir-Adleman (RSA) algorithm.

According to the RSA algorithm, a value encrypted with the private key <NUM> of the authentication web server <NUM> being decryptable by the public key <NUM> on the authentication API server <NUM> is a guarantee that the encrypted value was encrypted with the private key <NUM> of the authentication web server <NUM>.

The authentication API server <NUM> may receive the public key <NUM> generated in the encryption module <NUM> of the authentication web server <NUM> from the authentication web server <NUM>. The received public key <NUM> may be stored in the encryption module <NUM> of the authentication API server <NUM>. In some implementations, the authentication API server <NUM> may determine whether a request received from the SSO agent <NUM> is valid using the received public key <NUM>. For example, the authentication API sever <NUM> may verify that the request is valid using the public key <NUM> received from the authentication web server <NUM>. Meanwhile, an eigenvalue is received from the electronic device <NUM>, if the eigenvalue is decryptable.

In some implementations, in response to it being determined that the request received from the SSO agent <NUM> is not valid, the authentication API server <NUM> may transmit a rejection message that the authentication request is rejected to the SSO agent <NUM>. In some implementations, the authentication API server <NUM> may only respond when the electronic device <NUM> has the user authentication information <NUM> or the user login authentication information <NUM>, and the authentication API server <NUM> may not respond when the request is not authenticated.

<FIG> illustrates a method <NUM> of transmitting authentication information to a browser according to various example embodiments. For example, an electronic device (e.g., the electronic device <NUM>) may transmit authentication information (e.g., the authentication information <NUM>) to a browser (e.g., the browser <NUM>).

Referring to <FIG>, before operation <NUM> of the method <NUM>, a login to the electronic device with an account of a user <NUM> is completed, for example, when a login to the SSO agent <NUM> with an account of a user is completed. As another example, the electronic device may log in to the SSO agent <NUM> with the account of the user by receiving account information of the user when the SSO agent <NUM> is executed according to a request by the authentication web server <NUM> or before a local host web server (e.g., the local host web server <NUM>) calls the authentication API server <NUM>.

In operation <NUM> of the method <NUM>, the electronic device may access the service web server <NUM> via a browser according to an input of a user (e.g., user <NUM>). Accessing the service web server <NUM> via the browser may include, for example, executing a service web page (e.g., the service web page <NUM>) on the browser in response to a message received from the service web server <NUM>.

In operation <NUM> of the method <NUM>, in response to a user login request being received by the service web server <NUM>, an authentication web page (e.g., the authentication web page <NUM>) may be executed, and the login request may be transmitted to the authentication web server <NUM>. The electronic device may communicate with the authentication web server (e.g., the authentication web server <NUM>) in order to execute the authentication web page.

The login request received in operation <NUM> may be, for example, a request to log in using authentication information stored in the electronic device, or a request to log in by inputting an ID and a password. In response to the request to log in using the authentication information stored in the electronic device being received in operation <NUM>, a method of logging in using the authentication information stored in the electronic device may be performed (described further below). In response to the request to log in by inputting an ID and a password being received in operation <NUM>, the authentication web page <NUM> may be executed, and login may be performed by inputting an ID and a password on the authentication web page <NUM>.

In operation <NUM> of the method <NUM>, the authentication web server <NUM> may determine whether an operating system (OS) supports the method of providing login information.

In operation <NUM> of the method <NUM>, in response to an input to log in to a user service web server with information of an account the electronic device is logged in to being received on the authentication web server <NUM>, the authentication web server <NUM> may execute the SSO agent <NUM> of the electronic device.

In some implementations, the authentication web server <NUM> may generate a port number and transmit the port number to the SSO agent <NUM>. The authentication web server <NUM> may generate the port number as a random value within a set range. The random value for the port (random port) may be, for example, an integer between <NUM> and <NUM>. The SSO agent <NUM> may generate the local host web server <NUM> to use the random port. By generating and transmitting the random value to be used by the local host web server <NUM>, it may be possible to prevent a static port from being exposed, thereby reducing a chance of malicious attacks and enhancing security of user account information.

In operation <NUM> of the method <NUM>, in response to the authentication web server <NUM> executing the SSO agent <NUM>, the SSO agent <NUM> may generate the local host web server <NUM>. In some implementations, if the SSO agent <NUM> receives a port number from the authentication web server <NUM>, the SSO agent <NUM> may generate the local host web server <NUM> according to the received port (e.g., according to a random port).

In operation <NUM> of the method <NUM>, the authentication web server <NUM> may transmit a request for authentication information of a user to the SSO agent <NUM>. For example, the authentication web server <NUM> may transmit the request for authentication information of a user to the local host web server <NUM> of the SSO agent <NUM>.

In operation <NUM> of the method <NUM>, the SSO agent <NUM> may verify a browser. For example, the SSO agent <NUM> may verify whether the browser is a set browser. In some implementations, to prevent account information from being extorted when a user Hypertext Transfer Protocol (HTTP) request is forged or manipulated by a browser, verification may be performed on the browser to verify whether the browser is qualified to request login information.

In operation <NUM> of the method <NUM>, the SSO agent <NUM> may verify the authentication web server <NUM>. For example, the SSO agent <NUM> may verify the authentication web server <NUM> using referer information on a subject requesting account information to block an account information request from a fake site. In some implementations, the SSO agent <NUM> may terminate when a received request is not from an authentication web server, for example, when the received request is not from the authentication web server <NUM>. In some implementations, the SSO agent <NUM> may verify a browser and verify whether the request is from the authentication web server, and execute the local host web server.

In some implementations, the authentication web server <NUM> may request a random number value from the SSO agent <NUM>. For example, the authentication web server <NUM> may request a random number value from the local host web server <NUM> of the SSO agent <NUM>. In some implementations, the authentication web server <NUM> may transmit a request for the random number value with the request for authentication information of a user transmitted to the SSO agent <NUM> in operation <NUM>.

In operation <NUM> of the method <NUM>, the SSO agent <NUM> may generate a random number value and transmit the generated random number value to the authentication web server <NUM>. In some implementations, the SSO agent <NUM> may transmit the generated random number value only to the authentication web server <NUM>. The SSO agent <NUM> may transmit the random number value only to the authentication web server <NUM> to prevent a random website from requesting a random number value from the local host web server <NUM> and receiving the returned random number value from the local host web server <NUM>.

In some implementations, a data transmission among the local host web server <NUM> of the SSO agent <NUM>, the service web server <NUM>, and the authentication web server <NUM> may be a message exchange via a local host. For example, a message exchange by HTTP protocol may correspond to a message exchange occurring in a local host rather than on an external network. For example, operations <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> may be message exchanges occurring in the local host. Exchanging a message in the local host and using the generated random number may prevent data from being extorted by the external network. The local host may be the electronic device or the local host web server.

In operation <NUM> of the method <NUM>, the authentication web server <NUM> may generate an eigenvalue by encrypting the random number value (received in operation <NUM>) with a private key (e.g., the private key <NUM>). In some implementations, the authentication web server <NUM> may encrypt a random number value and a timestamp (e.g., a time when a random number value is received) together. For example, the authentication web server <NUM> may cryptographically sign by adding the random number value and the timestamp using a byte array. In some implementations, the eigenvalue generated by the authentication web server <NUM> may be received by the local host web server <NUM> of the electronic device.

In operation <NUM> of the method <NUM>, the authentication web server <NUM> may transmit a request to verify the eigenvalue to the SSO agent <NUM>. In some implementations, the authentication web server <NUM> may transmit the eigenvalue to the local host web server <NUM>.

In operation <NUM> of the method <NUM>, the local host web server <NUM> in the SSO agent <NUM> may transmit a request to authenticate the eigenvalue to the authentication API server <NUM>. In some implementations, in operation <NUM>, the electronic device may call the authentication API server <NUM> by transmitting a user authentication token, for example, authentication information, stored in the electronic device along with the eigenvalue to the authentication API server <NUM>. For example, the user authentication token may be a token that the SSO agent <NUM> receives in response to a user account being logged in to. In some implementations, in response to calling the authentication API server <NUM>, the local host web server <NUM> may transmit an encrypted eigenvalue received from the authentication web server <NUM>.

In operation <NUM> of the method <NUM>, the authentication API server <NUM> may authenticate the eigenvalue. In some implementations, the authentication API server <NUM> may store a public key (e.g., the public key <NUM>) generated by the authentication web server <NUM>. The authentication API server <NUM> may store the stored public key corresponding to the authentication web server <NUM>. For example, in response to an identifier of the authentication web server <NUM> being "A", an identifier of the public key generated by the authentication web server "A" may correspond to "A", and the public key may be stored.

For example, in response to the eigenvalue received from the SSO agent <NUM> being encrypted by the authentication web server "A", the authentication API server <NUM> may decrypt the eigenvalue using the public key "A". In response to the authentication API server <NUM> decrypting the eigenvalue using the public key "A", it may be verified that the received eigenvalue is from the electronic device. The eigenvalue being decrypted by the public key "A" is a guarantee that the eigenvalue was encrypted on the authentication web server "A". In response to the received eigenvalue being decrypted by the public key received from the authentication web server <NUM>, the authentication API server <NUM> may determine that a request received from the local host web server <NUM> is from the authentication web server <NUM>.

In some implementations, in operation <NUM>, the authentication API server <NUM> may verify whether the user authentication token received from the SSO agent <NUM> is a user authentication token of a user logged in to a service. For example, it may be possible to verify whether the token is a user authentication token issued when the SSO agent <NUM> logged in with user account information.

In operation <NUM> of the method <NUM>, the authentication API server <NUM> may separate the random number and the timestamp from the byte array of the decrypted eigenvalue. The authentication API server <NUM> may determine whether the separated timestamp is within a valid time range, for example, within a set time (e.g., within a set time range from a time when a request is received from the local host web server <NUM>).

In operation <NUM> of the method <NUM>, the authentication API server <NUM> may determine whether the random number value separated from the byte array is valid. For example, the authentication API server <NUM> may store the random number value separated from the byte array during a period set in the electronic device such as a cache memory. The authentication API server <NUM> may determine whether the random number value decrypted from the received eigenvalue is a duplicate value using the random number value stored in the electronic device. If the random number value decrypted from the received eigenvalue matches the random number value stored in the electronic device, the request received from the SSO agent <NUM> may be a duplicate request.

In operation <NUM> of the method <NUM>, the authentication API server <NUM> may transmit the eigenvalue and/or a result of authenticating the user authentication token to the SSO agent <NUM>. For example, the authentication API server <NUM> may inform the local host web server <NUM> whether the request received from the local host web server <NUM> is validated based on a result of authenticating or validating the user authentication token and/or the eigenvalue. In response to the request received from the local host web server <NUM> not being validated (e.g., in response to a user authentication token being not valid, in response to an eigenvalue being not decrypted with a public key, in response to a timestamp exceeding a set time, and in response to a random number being identical to a random number stored in the electronic device), the authentication API server <NUM> may inform the local host web server <NUM> that the corresponding request is a malicious request transmitted by a random proxy web server.

In operation <NUM> of the method <NUM>, in response to the eigenvalue being authenticated as valid by the authentication API server <NUM>, the SSO agent <NUM> may transmit the authentication information to the authentication web server <NUM>. In some implementations, in operation <NUM>, in response to the request being verified as a normal request by the authentication API server <NUM>, the local host web server <NUM> may transmit the user authentication information to the authentication web server <NUM>.

The authentication web server <NUM> may allow login to a service web server with an account of a user to be performed using authentication information of the user.

In operation <NUM> of the method <NUM>, the SSO agent <NUM> may send a notification informing the user <NUM> that login is complete. In some implementations, in operation <NUM>, in response to the SSO agent <NUM> transmitting the authentication information to the authentication web server <NUM>, the SSO agent <NUM> may display a message on a display module of the electronic device that login to the service web page <NUM> or the authentication web page <NUM> is completed. In some implementations, the service web page <NUM> and/or the authentication web page <NUM> may be executed on the browser in response to a message received from the service web server <NUM> and/or the authentication web server <NUM>.

A login completion notification message may be displayed on the display module of the electronic device as described above, or may be output as voice or sound through a sound output module (e.g., the sound output module <NUM>) of the electronic device.

For example, a notification message that login on a browser by which authentication information is received is complete may be provided. For example, the browser may display a message that the login is complete on the display module of the electronic device.

In operation <NUM> of the method <NUM>, in response to the authentication information being transmitted to the authentication web server <NUM>, the local host web server <NUM> may terminate, and in operation <NUM> of the method <NUM>, the SSO agent <NUM> may terminate. Since the local host web server <NUM> and the SSO agent <NUM> transmit the authentication information of the user to the authentication web server <NUM> and then terminate, by this process it may be possible to prevent access by an external network.

According to various example embodiments, a method of providing login information may include sending, from a service web page <NUM> executed on a browser <NUM>, a login request to an authentication web page <NUM> executed on the browser <NUM>, executing, by the authentication web page <NUM>, an SSO agent <NUM> in an electronic device <NUM>, sending, by the authentication web page <NUM>, a request for authentication information of a user to the SSO agent <NUM>, generating, by the SSO agent <NUM>, a random number and transmitting the random number to the authentication web page <NUM>, generating an encrypted eigenvalue on an authentication web server <NUM> based on the random number and transmitting the eigenvalue to the SSO agent <NUM>, calling, by the SSO agent <NUM>, an authentication API server <NUM> to transmit the eigenvalue, validating the eigenvalue on the authentication API server <NUM>; and receiving, by the SSO agent <NUM>, a result of the validating from the authentication API server <NUM>, and transmitting the authentication information <NUM> to the authentication web server <NUM>.

The executing of the SSO agent <NUM> may include receiving, by the SSO agent <NUM>, a random port number from the authentication web page <NUM>, and executing a local host web server <NUM> to communicate with the authentication web server <NUM> and the authentication API server <NUM> in the SSO agent <NUM> based on the port number.

The transmitting of the random number to the authentication web page <NUM> may include verifying whether the browser <NUM> is a set browser <NUM>, verifying the authentication web page <NUM> from which the request for the authentication information <NUM> is sent, and transmitting the random number to the authentication web page <NUM>.

The transmitting of the eigenvalue to the SSO agent <NUM> may include generating, by the authentication web server <NUM>, the eigenvalue by encrypting the random number and a timestamp using a private key <NUM>.

The validating of the eigenvalue may include decrypting the eigenvalue using a public key <NUM> corresponding to the private key <NUM> and stored in the authentication API server <NUM>.

The validating of the eigenvalue may include verifying whether the random number of the decrypted eigenvalue is used, and verifying whether the timestamp falls within a set time.

The transmitting of the authentication information to the authentication web server <NUM> may include transmitting the authentication information to the authentication web server <NUM> and then terminating the SSO agent <NUM>.

According to various example embodiments, a method of providing login information may include sending, from a service web page <NUM> executed on a browser <NUM>, a login request to an authentication web page <NUM> executed on the browser <NUM>, executing, by the authentication web page <NUM>, an SSO agent <NUM> in an electronic device <NUM>, sending, by the authentication web page <NUM>, a request for authentication information <NUM> of a user to the SSO agent <NUM>, generating, by the SSO agent <NUM>, a random number, and transmitting the random number to the authentication web page <NUM>, generating an eigenvalue by encrypting the random number and a timestamp on an authentication web server <NUM> using a private key, and transmitting the eigenvalue to the SSO agent <NUM>, calling, by the SSO agent <NUM>, an authentication API server <NUM> using a user authentication token stored in the electronic device <NUM> to transmit the eigenvalue, validating the user authentication token on the authentication API server <NUM>, and decrypting the eigenvalue using a public key <NUM> corresponding to the private key <NUM> to validate the eigenvalue, and receiving, by the SSO agent <NUM>, a result of the validating from the authentication API server <NUM>, and transmitting the authentication information <NUM> to the authentication web server <NUM>.

The executing of the SSO agent <NUM>, the sending of the request for the authentication information <NUM>, and the transmitting of the random number to the authentication web page <NUM> may include using a message exchanged in the electronic device <NUM>.

According to various example embodiments, an electronic device <NUM> may include at least one processor <NUM>, and a memory <NUM> configured to store instructions executed by the processor <NUM>, a browser <NUM>, and an SSO agent, wherein, the browser <NUM> is configured to access a service web server <NUM> and an authentication web server <NUM> to execute a service web page <NUM> and an authentication web page <NUM>, the SSO agent <NUM> is configured to log in to the electronic device <NUM> and/or the service web server <NUM>, and the at least one processor <NUM> is configured to, in response to the instructions being executed by the processor <NUM>, send, from the service web page <NUM> executed on the browser <NUM>, a login request to the authentication web page <NUM> executed on the browser <NUM>, cause the authentication web page <NUM> to execute the SSO agent <NUM>, and to send a request for authentication information <NUM> of a user to the SSO agent <NUM>, and cause the SSO agent <NUM> to generate a random number and transmit the random number to the authentication web page <NUM>, to call an authentication API server <NUM> to transmit the eigenvalue, and to receive a validation result of the eigenvalue from the authentication API server <NUM> and transmit the authentication information <NUM> to the authentication web server <NUM>.

The at least one processor <NUM> may be configured to cause the SSO agent <NUM> to, in response to the instructions being executed by the processor <NUM>, receive a random port number from the authentication web page <NUM>, and execute a local host web server <NUM> to communicate with the authentication web server <NUM> and the authentication API server <NUM> in the SSO agent <NUM> based on the port number.

The at least one processor <NUM> may be configured to cause the SSO agent <NUM> to, in response to the instructions being executed by the processor <NUM>, verify whether the browser <NUM> is a set browser <NUM>, verify the authentication web page <NUM> from which the request for the authentication information <NUM> is sent, and transmit the random number to the authentication web page <NUM>.

The eigenvalue may be obtained, by the authentication web server <NUM>, by encrypting the random number and a timestamp using a private key <NUM>.

The authentication API server <NUM> may be configured to decrypt the eigenvalue using a public key <NUM> corresponding to the private key <NUM> and stored in the authentication API server <NUM> to validate the eigenvalue.

The at least one processor <NUM> may be configured to, in response to the instructions being executed by the processor <NUM>, transmit the authentication information <NUM> to the authentication web server <NUM> and then terminate the SSO agent <NUM>.

The electronic device <NUM> may perform one or more processes or functions described herein. The electronic device <NUM> may perform operations based on the processor <NUM> executing software instructions stored by a non-transitory computer-readable medium, such as the memory <NUM>. A computer-readable medium is defined herein as a non-transitory memory device. A memory device includes memory space within a single physical storage device or memory space spread across multiple physical storage devices.

Software instructions may be read into the memory <NUM> from another computer-readable medium or from another device via the communication module <NUM>. When executed, software instructions stored in the memory <NUM> may cause the processor <NUM> to perform one or more processes described herein.

Thus, embodiments described herein are not limited to any specific combination of hardware circuitry and software.

The number and arrangement of components shown in <FIG> and <FIG> are provided as an example. In practice, the electronic device <NUM> may include additional components, fewer components, different components, or differently arranged components than those shown in <FIG> and <FIG>. Additionally, or alternatively, a set of components (e.g., one or more components) of the device <NUM> may perform one or more functions described as being performed by another set of components of the device <NUM>.

In embodiments, any one of the operations or processes of <FIG>, <FIG> or <FIG> may be implemented by or using any one of the elements illustrated in <FIG> and <FIG>.

Some embodiments may relate to a system, a method, and/or a computer readable medium at any possible technical detail level of integration. Further, one or more of the above components described above may be implemented as instructions stored on a computer readable medium and executable by at least one processor (and/or may include at least one processor). The computer readable medium may include a computer-readable non-transitory storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out operations.

Computer readable program code/instructions for carrying out operations may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, configuration data for integrated circuitry, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++, or the like, and procedural programming languages, such as the "C" programming language or similar programming languages. In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects or operations.

The electronic device according to various example embodiments may be one of various types of electronic devices. The electronic device may include, for example, a portable communication device (e.g., a smartphone), a computer device, a portable multimedia device, a portable medical device, a camera, a wearable device, or a home appliance device. According to an example embodiment of the disclosure, the electronic device is not limited to those described above.

It should be appreciated that various example embodiments of the present disclosure and the terms used therein are not intended to limit the technological features set forth herein to particular embodiments and include various changes, equivalents, or replacements for a corresponding embodiment. In connection with the description of the drawings, like reference numerals may be used for similar or related components. As used herein, "A or B", "at least one of A and B", "at least one of A or B", "A, B or C", "at least one of A, B and C", and "A, B, or C," each of which may include any one of the items listed together in the corresponding one of the phrases, or all possible combinations thereof. Terms such as "first", "second", or "first" or "second" may simply be used to distinguish the component from other components in question, and do not limit the components in other aspects (e.g., importance or order). It is to be understood that if an element (e.g., a first element) is referred to, with or without the term "operatively" or "communicatively", as "coupled with," "coupled to," "connected with," or "connected to" another element (e.g., a second element), it means that the element may be coupled with the other element directly (e.g., wired), wirelessly, or via a third element.

As used in connection with various example embodiments of the disclosure, the term "module" may include a unit implemented in hardware, software, or firmware, and may interchangeably be used with other terms, for example, "logic," "logic block," "part," or "circuitry". For example, according to an example embodiment, the module may be implemented in a form of an application-specific integrated circuit (ASIC).

Claim 1:
A method of providing login information, the method comprising:
sending (<NUM>), from a service web page executed on a browser, a login request to an authentication web page executed on the browser;
executing (<NUM>), by the authentication web page, a single sign on, SSO, agent in an electronic device;
sending (<NUM>), by the authentication web page, a request for authentication information of a user to the SSO agent;
generating, by the SSO agent, a random number and transmitting (<NUM>) the random number to the authentication web page;
generating (<NUM>) an encrypted eigenvalue on an authentication web server (<NUM>) based on the random number and transmitting the encrypted eigenvalue to the SSO agent (<NUM>);
calling (<NUM>), by the SSO agent, an authentication application programming interface, API, server (<NUM>), by transmitting the encrypted eigenvalue;
validating (<NUM>, <NUM>, <NUM>) the encrypted eigenvalue on the authentication API server; and
receiving (<NUM>), by the SSO agent, a result of the validating from the authentication API server, and transmitting (<NUM>) the authentication information to the authentication web server.