Access Token Session Sync Between IDM and API Gateway
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud architectures, the synchronization of session states between an Identity Manager (IDM) and Application Programming Interface (API) Gateway is not maintained after a user logs out, leading to security vulnerabilities as access tokens persist and can be used by unauthorized users during the token's remaining validity period.
Innovation Solution
Implementing a distributed cache to synchronize the session state of access tokens between IDM and API Gateway, where the API Gateway verifies token validity and fetches session state information from the distributed cache to ensure synchronized authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the API Gateway authenticates tokens based on signature validation and expiration time only, then token validation is simple and fast, but security is compromised as tokens persist after user logout
Solution Approach 1:
The patent introduces a distributed cache as an intermediary component between the API Gateway and IDM. The cache stores session state information (authenticated/unauthenticated status) for each token, allowing the API Gateway to verify both token expiration and authentication state without direct IDM communication. This resolves the contradiction by adding security through session state tracking while maintaining relatively simple authentication logic at the gateway.
2Ease of operation
If the token expiration time is set longer to allow legitimate user access, then user convenience is improved, but security risk increases as tokens can be used by unauthorized users after logout
Solution Approach 1:
The patent implements a feedback mechanism where the API Gateway continuously checks the authentication state of tokens in the distributed cache. When a user logs out at the IDM, the session state is updated in the cache, and subsequent token presentations are checked against this updated state. This allows longer token expiration times for user convenience while preventing unauthorized access through real-time authentication state feedback.
3Reliability
If the API Gateway checks session state with every token validation, then synchronization with IDM is maintained, but processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-storing session state information in the distributed cache before token validation is needed. When users authenticate at the IDM, their session state is proactively written to the cache. During token validation, the API Gateway simply reads the pre-stored state from cache rather than querying the IDM in real-time, significantly reducing validation time while maintaining synchronization.
Data Source
AI summary
Synchronization of a session state of an access token is provided between elements in a system, such as between an Identity Manager (IDM) and an Application Programming Interface (API) Gateway. The IDM generates an access token that is provided to a client device and stores session state information of the access token at a distributed cache. When the client device logs out from the IDM, the IDM removes the session state information from the distributed storage device. The API Gateway is able to request the session state information from distributed storage device. Based on receiving the session state information, the API Gateway authenticates the access token and grants the client device access to an end service. Before requesting the session state information from the distributed storage device, the API Gateway is able to verify the access token is valid and that the access token has not expired.