Aliasing Scopes in Access Tokens to Reduce Size
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Access tokens in authentication systems face issues due to increasing size, which causes problems with web servers and network bandwidth, and are not encrypted, making them visible and vulnerable to malicious actors.
Innovation Solution
The introduction of alias scopes, which represent one or more scopes assigned to a user with a shorter value, reducing the size of access tokens and obfuscating the scopes without the need for encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If access tokens include detailed scope information, then user permissions are clearly defined, but token size increases causing network bandwidth issues
Solution Approach 1:
The patent creates alias scopes that are simplified copies or representations of the actual scopes. Instead of including the full scope string in the access token, the system uses a compact alias (e.g., a short code or identifier) that maps to the complete scope information stored elsewhere in the system. This copying approach maintains the informational value while dramatically reducing token size and network bandwidth consumption.
2Device complexity
If access tokens are transmitted in plain text, then processing is simple, but tokens are visible to malicious actors
Solution Approach 1:
The patent introduces alias scopes as an intermediary layer between the actual scope information and the access token. The alias acts as a mediator that can be safely transmitted in plain text within the token, while the mapping between aliases and actual scopes is maintained securely in the authorization server. This intermediary approach allows simple token processing while protecting the actual scope information from exposure.
3Loss of energy
If alias scopes are introduced to reduce token size, then network bandwidth is conserved, but system complexity increases due to alias management
Solution Approach 1:
The patent makes the authorization server universal by giving it the additional responsibility of maintaining and managing the alias-to-scope mappings. Instead of distributing this management complexity across multiple components, the system consolidates it in the authorization server, which already handles authentication and token issuance. This multi-functionality approach adds complexity to one existing component rather than creating new complex interactions between multiple components.
Data Source
AI summary
Systems, apparatus, articles of manufacture, and methods are disclosed for aliasing scopes in access tokens. An example apparatus includes interface circuitry, machine readable instructions, and programmable circuitry to at least one of instantiate or execute the machine readable instructions to detect a request to create an identity to access an online resource, the message including at least one scope assignment associated with a user of the computing device, determine that an alias has not been created for the at least one scope assignment, the alias to represent two more scopes assigned to the user, and generate the alias for the scope assignment, the alias having less characters than the scope assignment.