Banking API Token Validation to Prevent Replay Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current application security systems rely on a single gateway module, which is a single point of failure, and fail to provide adequate security against web-based and mobile banking requests, especially vulnerable to replay attacks due to session tokens remaining valid throughout the user session.
Innovation Solution
Implement a system that issues new session tokens, such as MORF tokens, for each request, requiring validation for every request, and includes multiple layers of token validation across various components to ensure security and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single gateway module is used for application security, then the system structure is simple, but the system becomes a single point of failure and reliability decreases
Solution Approach 1:
The patent divides the security validation function into multiple independent validation modules (JWT validator, CSRF validator, MORF validator) that operate in parallel. Each module validates specific aspects of security tokens independently, eliminating the single point of failure while maintaining overall system security. The validation results are aggregated to determine final access permission.
2Speed
If session tokens remain valid throughout the user session, then authentication speed is fast, but the system becomes vulnerable to replay attacks
Solution Approach 1:
The patent implements periodic token validation by issuing new MORF tokens with each API request. Instead of using a single long-lived session token, the system generates fresh tokens for each request cycle. This periodic token issuance maintains authentication speed while preventing replay attacks, as captured tokens become invalid after their specific request cycle expires.
Solution Approach 2:
The system performs preliminary validation of multiple token types (JWT, CSRF, MORF) before allowing access to protected resources. The MORF token validation occurs as a preliminary step before the main business logic executes, ensuring security is established in advance without delaying the overall request processing time.
3Reliability
If multiple token validation layers are implemented, then security against replay attacks improves, but the validation process becomes more complex
Solution Approach 1:
The validation process is segmented into distinct, independent validation modules: JWT validation module, CSRF validation module, and MORF validation module. Each module handles specific validation logic separately, making the complex multi-layer validation process more manageable and maintainable. The modular architecture allows each validator to be optimized independently.
Solution Approach 2:
The patent introduces a validation coordinator that acts as an intermediary between the multiple validation modules and the access control system. The coordinator collects validation results from all modules, determines overall access permission, and coordinates the validation flow. This intermediary layer simplifies the complexity by centralizing the decision-making logic.
Data Source
AI summary
Systems and methods for application security improvements are provided. The systems and methods may receive a banking request, including a request header, from a web browser or mobile application. Thereafter, a session cookie may be extracted from the request header. The session cookie may include one or more of a CSRF token, a MORF token, and a JWT. Thereafter, an outer API may validate the one or more tokens and create a validated banking request object. Upon such validations, a financial institution's APIs may allow a banking request to proceed with a high degree of confidence that the request is free of interference by bad actors and fraud. The validated banking request object may be transmitted to an inner API to accomplish the banking request. Thus, the system and methods described herein provide an improved system for application security, which decreases rates of fraud below that of known systems.