Banking Request Token Validation to Prevent Replay Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current application security systems for web-based and mobile banking applications are vulnerable to replay attacks and rely on a single gateway module, which is a single point of failure, and fail to provide adequate security by only validating tokens at the start of the user session.
Innovation Solution
Implement a system that issues new session tokens, such as MORF tokens, for each request, requiring validation for every request, and includes multiple layers of token validation across various components to ensure security and redundancy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single gateway module is used for application security, then the system structure is simple, but the system becomes a single point of failure and reliability decreases
Solution Approach 1:
The patent divides the security validation function into multiple independent validation modules (JWT validator, CSRF token validator, MORF token validator) that operate in parallel rather than through a single gateway. Each validation module can function independently, eliminating the single point of failure while maintaining security validation coverage across all request types.
2Speed
If token validation is performed only at the start of user session, then the validation process is fast, but replay attacks can occur and security decreases
Solution Approach 1:
The patent implements periodic token validation by generating new MORF tokens for each request and validating them continuously throughout the user session. This periodic validation approach prevents replay attacks by ensuring that tokens are fresh and not reused, while the validation process remains efficient through optimized token verification mechanisms.
3Object-affected harmful factors
If multiple token validation layers are implemented, then security against replay attacks improves, but the validation process becomes more complex and time-consuming
Solution Approach 1:
The validation process is segmented into distinct validation stages: JWT validation, CSRF token validation, and MORF token validation. Each stage is handled by a dedicated validation module that processes specific token types independently. This segmentation allows the system to maintain multiple validation layers for enhanced security while managing complexity through modular architecture and clear separation of concerns.
Data Source
AI summary
Systems and methods for application security improvements are provided. The systems and methods may receive a banking request, including a request header, from a web browser or mobile application. Thereafter, a session cookie may be extracted from the request header. The session cookie may include one or more of a CSRF token, a MORF token, and a JWT. Thereafter, an outer API may validate the one or more tokens and create a validated banking request object. Upon such validations, a financial institution's APIs may allow a banking request to proceed with a high degree of confidence that the request is free of interference by bad actors and fraud. The validated banking request object may be transmitted to an inner API to accomplish the banking request. Thus, the system and methods described herein provide an improved system for application security, which decreases rates of fraud below that of known systems.