Client Identity Propagation via Digital Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Service provider companies face challenges in securely propagating client identity and authorization in service calls across systems while providing access to data through open APIs, which limits the potential uses of financial data and increases security risks.
Innovation Solution
A computer system and method that propagate client identity in service calls by digitally signing identity information and validating digital signatures in the header of request messages, ensuring secure authentication and authorization through an open API platform, allowing for additional features in responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access to financial data is restricted to approved users only, then security is improved, but the potential uses of the data are limited
Solution Approach 1:
The patent segments the authentication and authorization process into distinct components: identity propagation in service calls, digital signature validation, and profile-based authorization. This allows different levels of access control for different data and services, enabling both security and versatile data usage by appropriately segmenting access rights.
Solution Approach 2:
The patent introduces an intermediary authentication framework that acts as a mediator between developers and financial data. The framework uses profile information and digital signatures to verify identities, allowing secure access for approved developers while maintaining data security. This intermediary layer enables versatile data usage without compromising security.
2Productivity
If open API access is provided to developers, then transaction volume and service capabilities are increased, but security risks are created
Solution Approach 1:
The patent implements preliminary authentication actions where profile information is established and digital signatures are pre-configured before developers access financial data. The system validates identities upfront through profile verification and digital signature checks, preventing unauthorized access while allowing legitimate high-volume transactions.
Solution Approach 2:
The patent incorporates feedback mechanisms through digital signature validation and profile verification that provide continuous security monitoring. The system receives service calls with embedded identities, validates them against stored profiles, and provides authorization feedback, enabling secure high-volume transactions with real-time security verification.
3Reliability
If digital signature validation is implemented for each service call, then authentication security is improved, but system complexity increases
Solution Approach 1:
The patent merges the identity propagation and authentication verification processes into a unified service call framework. Profile information, digital signatures, and validation logic are combined into an integrated authentication mechanism that operates transparently within the existing service architecture, reducing overall system complexity while maintaining strong security.
Data Source
AI summary
A method and system for securely propagating client identities in a service call from a first system to a target service system are provided. The system includes a memory device for storing data and a service provider (SP) computer system. The SP computer system is programmed to determine identities to transmit to the target system in association with a request, construct a data structure to represent each identity and additional information related to the identity, digitally sign the identity information, pair the identity information and the corresponding digital signature in a header of a request message from the first system to the target service system, receive the request message and extract the identity information and corresponding digital signatures from the header, validate the corresponding digital signatures, and construct using the corresponding identity information a data structure that represents each of the original identities established in the first system.