Banking API Security with Distributed Validation and MORF Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current application security systems for web-based and mobile banking applications rely on a single gateway module, which is a single point of failure, and are vulnerable to replay attacks due to session tokens remaining valid throughout the user session, failing to provide adequate security against unauthorized access.
Innovation Solution
Implement a system that issues new session tokens, such as MORF tokens, for each request, requiring validation for every request, and utilizes multiple validation points to ensure security, including reverse proxies, validators, and token verification across various components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single gateway module is used for application security, then the system structure is simple, but the system becomes a single point of failure and reliability deteriorates
Solution Approach 1:
The patent divides the security gateway into multiple distributed security validation points (validators) that are spread across different system components. Instead of a single centralized gateway, multiple validators independently perform security validation, eliminating the single point of failure while maintaining consistent security policies across the distributed architecture.
Solution Approach 2:
The patent transitions from a single-point security validation model to a multi-dimensional distributed validation model. Security validation is performed at multiple levels and locations (different validators, multiple validation points) rather than at a single gateway, adding spatial and functional dimensions to the security architecture.
2Speed
If session tokens remain valid throughout the user session, then authentication speed is improved, but the system becomes vulnerable to replay attacks
Solution Approach 1:
The patent implements periodic token validation and renewal mechanisms where session tokens are validated at multiple validation points and can be renewed or rotated during the user session. This periodic action ensures that tokens remain valid for continuous access (maintaining speed) while being actively monitored and refreshed to prevent replay attacks.
Solution Approach 2:
The patent introduces feedback mechanisms where validation results from multiple validators are fed back into the system to dynamically adjust token validity and authentication decisions. This feedback loop allows the system to maintain fast authentication while detecting and preventing replay attacks through continuous validation and token renewal based on validation feedback.
3Device complexity
If JWTs or CSRF tokens are retrieved and validated only once at the start of user session, then validation complexity is reduced, but security coverage for subsequent requests deteriorates
Solution Approach 1:
The patent performs preliminary security validation actions at multiple validation points throughout the request lifecycle, not just at session start. Each validator performs preliminary validation of security tokens before allowing requests to proceed, ensuring comprehensive security coverage while distributing the validation complexity across multiple independent components.
Solution Approach 2:
The patent makes multiple validators universal by enabling them to perform the same security validation functions (JWT verification, CSRF token validation, MORF token validation) across different system components. This multi-functionality ensures consistent security coverage throughout the application while allowing each validator to operate independently, managing complexity through standardized validation logic.
4Object-affected harmful factors
If new session tokens are issued for each request, then replay attack protection is improved, but the validation process complexity increases
Solution Approach 1:
The patent segments the token validation process into multiple independent validation points, each handling token verification for specific requests. This segmentation allows new tokens to be issued and validated for each request (improving replay protection) while distributing the validation complexity across multiple specialized validators rather than concentrating it in a single complex validation process.
Data Source
AI summary
Systems and methods for application security improvements are provided. The systems and methods may receive a banking request, including a request header, from a web browser or mobile application. Thereafter, a session cookie may be extracted from the request header. The session cookie may include one or more of a CSRF token, a MORF token, and a JWT. Thereafter, an outer API may validate the one or more tokens and create a validated banking request object. Upon such validations, a financial institution's APIs may allow a banking request to proceed with a high degree of confidence that the request is free of interference by bad actors and fraud. The validated banking request object may be transmitted to an inner API to accomplish the banking request. Thus, the system and methods described herein provide an improved system for application security, which decreases rates of fraud below that of known systems.