Authorization Server Token Deletion Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the context of service cooperation, there is a risk of data leakage when access tokens are not properly managed, particularly in the same authentication domain, leading to potential data mismatch issues during service interactions.
Innovation Solution
An authorization server system is implemented with a management unit, providing a deletion screen and deletion unit to manage and delete authorization information only when explicitly requested by the user, thereby limiting access token deletion in the same authentication domain and preventing data mismatch.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If access tokens are deleted from the client side in the same authentication domain, then user data security is improved, but service cooperation reliability deteriorates due to data mismatch
Solution Approach 1:
The patent segments the authentication domain into two categories: same authentication domain (intra-domain) and different authentication domain (inter-domain). For intra-domain services, token deletion is restricted to maintain service reliability, while inter-domain services allow token deletion for security. This segmentation resolves the contradiction by applying different security policies to different contexts.
Solution Approach 2:
The patent applies different quality characteristics to different locations in the system. Specifically, it distinguishes between services within the same authentication domain and services across different domains, applying lenient token management policies locally within domains while maintaining strict policies for cross-domain operations. This local differentiation allows service cooperation to function reliably within domains while maintaining overall security.
2Object-affected harmful factors
If all authorization information is displayed for deletion, then user control over security is improved, but ease of operation deteriorates due to difficulty in identifying which tokens can be safely deleted
Solution Approach 1:
The patent introduces an intermediary mechanism (the authorization server) that mediates between the user's deletion request and the actual token deletion. The server acts as a smart intermediary that automatically determines which tokens can be deleted based on the authentication domain classification, relieving the user of the burden of making this complex judgment while maintaining security control.
Solution Approach 2:
The system provides self-service functionality where the authorization server automatically classifies and manages tokens based on their authentication domain. The server autonomously determines which tokens belong to intra-domain services (cannot be deleted) and which belong to inter-domain services (can be deleted), without requiring user expertise in authentication domain concepts.
3Productivity
If automatic token deletion is implemented, then productivity is improved, but reliability deteriorates due to potential data mismatch in service cooperation
Solution Approach 1:
The patent implements dynamic token management where the system automatically adjusts token deletion behavior based on real-time conditions. The authorization server dynamically evaluates each token deletion request by checking the authentication domain classification, enabling automatic efficiency gains while maintaining reliability through context-aware decision-making. This dynamic approach replaces static automatic deletion with intelligent adaptive management.
Data Source
AI summary
An authorization server system that manages authorization information configured to enable providing of a service without requiring input of authentication information, comprises: a management unit which manages the authorization information; a providing unit which provides a deletion screen that includes the authorization information generated when an authorization operation of a user is performed but not the authorization information generated without performing the authorization operation of the user in accordance with reception of a request of the deletion screen configured to delete the authorization information managed by the management unit; and a deletion unit which deletes the authorization information managed by the management unit, in accordance with reception of a deletion instruction via the deletion screen.