Layered Banking Request Validation Beyond Single Gateway Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current application security systems for web-based and mobile banking applications are vulnerable to replay attacks and rely on a single gateway module, which acts as a single point of failure, and fail to provide adequate security by only validating tokens at the start of the user session.
Innovation Solution
Implement a system that issues new session tokens, such as MORF tokens, for each request, requiring validation for every request, and includes multiple layers of token validation across various components to ensure security and redundancy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single gateway module is used for application security, then device complexity is reduced, but reliability deteriorates due to single point of failure
Solution Approach 1:
The patent divides the security gateway into multiple independent security validation components (first security validation component, second security validation component, third security validation component) that operate in parallel. Each component validates different aspects of security (JWT, CSRF, MORF tokens respectively), eliminating the single point of failure while maintaining manageable complexity through modular architecture.
2Loss of time
If session tokens are validated only at the start of user session, then validation time is reduced, but security deteriorates due to vulnerability to replay attacks
Solution Approach 1:
The patent implements continuous security validation by having multiple security validation components operate throughout the entire user session, not just at initialization. The first security validation component validates JWT tokens, the second validates CSRF tokens, and the third validates MORF tokens for every request, ensuring continuous security monitoring and validation throughout the session to prevent replay attacks.
Solution Approach 2:
The patent performs preliminary security validation by validating multiple token types (JWT, CSRF, MORF) before allowing any business logic to execute. The security validation components check authentication and authorization tokens in advance, ensuring that only legitimate requests proceed to the vertical slice processing, thereby preventing replay attacks before they can succeed.
3Reliability
If multiple layers of token validation are implemented, then security is improved, but device complexity increases
Solution Approach 1:
The patent segments the complex validation system into three distinct, independently functional security validation components. Each component handles a specific validation task (JWT, CSRF, MORF tokens) and can be implemented, maintained, and scaled independently. This segmentation reduces overall system complexity by breaking down the validation function into manageable modules while maintaining comprehensive security coverage.
Solution Approach 2:
The patent implements a universal validation architecture where multiple security validation components operate within the same vertical slice framework. Each validation component follows the same operational pattern (extract token, validate token, allow or deny request), making the system easier to understand and maintain. The vertical slice architecture provides a universal container that houses all validation logic, reducing structural complexity.
Data Source
AI summary
Systems and methods for application security improvements are provided. The systems and methods may receive a banking request, including a request header, from a web browser or mobile application. Thereafter, a session cookie may be extracted from the request header. The session cookie may include one or more of a CSRF token, a MORF token, and a JWT. Thereafter, an outer API may validate the one or more tokens and create a validated banking request object. Upon such validations, a financial institution's APIs may allow a banking request to proceed with a high degree of confidence that the request is free of interference by bad actors and fraud. The validated banking request object may be transmitted to an inner API to accomplish the banking request. Thus, the system and methods described herein provide an improved system for application security, which decreases rates of fraud below that of known systems.