Bilateral Web Session Authorization via OAuth 2.0 Extension
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web infrastructure is limited to unilateral sessions, where a resource on one website can access resources on another website but not vice versa, due to the limitations of existing web authorization protocols such as OAuth 2.0, HTTPS, and Kerberos, which do not support bilateral sessions.
Innovation Solution
The proposed solution extends the OAuth 2.0 protocol to enable bilateral sessions by adding parameters to authorization request and response messages, allowing both websites to access each other's resources within a single session.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing web authorization protocols (OAuth 2.0, HTTPS, Kerberos) are used, then web infrastructure maintains security and stability, but bilateral sessions between websites cannot be established
Solution Approach 1:
The patent modifies the OAuth 2.0 protocol by adding new parameters to authorization request and response messages. Specifically, it adds a 'bilateral' parameter to indicate bilateral session intent, and extends the scope parameter to include resources from both websites. This parameter extension allows the existing protocol framework to support bilateral sessions without breaking compatibility with current systems.
Solution Approach 2:
The patent segments the authorization process into distinct phases: initial unilateral authorization from the first website to the second website, and reciprocal authorization from the second website back to the first website. Each phase uses standard OAuth 2.0 flows, but the combination of both phases creates the bilateral session capability. This segmentation allows incremental adoption and maintains compatibility with systems that only implement unilateral authorization.
2Ease of operation
If unilateral sessions are used in current web infrastructure, then existing authorization protocols work as designed, but resources cannot be mutually accessed between websites
Solution Approach 1:
The patent merges two separate unilateral session authorizations into a single bilateral session. Instead of requiring two independent OAuth 2.0 flows with separate authentication and authorization steps, the system combines them into one unified session where both websites mutually authorize each other. This reduces the operational complexity for users while maintaining the security benefits of individual authorizations.
Solution Approach 2:
The bilateral session mechanism serves multiple functions: it enables mutual resource access between websites, maintains backward compatibility with unilateral sessions, and provides a framework that can be applied to various webRTC applications including email federation, presence sharing, and file sharing. The same protocol extension handles all these different use cases through a universal authorization mechanism.
3Adaptability or versatility
If OAuth 2.0 provides authorization to a fixed list of resources, then protocol stability is maintained, but dynamic addition and removal of resources is not possible
Solution Approach 1:
The patent makes the resource list dynamic by extending the scope parameter in OAuth 2.0 to accept flexible resource identifiers. Instead of a fixed predetermined list, the scope can now include dynamic resource references from both websites involved in the bilateral session. This allows resources to be added or removed during the session lifecycle while maintaining the overall protocol structure through standardized parameter handling.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
An apparatus for authorizing a bilateral session between two websites, comprising a processor configured to grant authorization for a first website to access a first resource located on a second website, grant authorization for the second website to access a second resource located on the first website, and establish the bilateral session between the first website and the second website when authorization is granted for the first website to access the first resource and authorization is granted for the second website to access the second resource, wherein the bilateral session supports the transfer of the first resource to the first website and the transfer of the second resource to the second website.