Composite Token Merging User and Service Identity

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In microservices-based architectures, the lack of awareness by called services about the user authorization status due to the absence of a user token in service tokens leads to unauthorized access and security vulnerabilities, such as impersonation and man-in-the-middle attacks.

Innovation Solution

Implementing a single token, like a JSON Web Token (JWT), that combines user and service profiles, allowing called services to validate both user and service authorization, and enabling token refreshing to maintain secure access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a service token is used for microservice authentication, then service-to-service communication is enabled, but the called service cannot determine user authorization status

Engineering Contradiction:

Improveauthorization validationVSAvoiduser token information

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent merges the service token and user token into a single composite token that contains both service identity and user authorization information. This allows the called microservice to validate both service authentication and user authorization simultaneously, resolving the information loss problem where user token details were previously unavailable to called services.

Inventive Principle:

Principle #5Merging (Combining)

2Reliability

If separate user token and service token validation is implemented, then comprehensive authorization checking is achieved, but system complexity increases

Engineering Contradiction:

Improveauthorization securityVSAvoidauthentication process

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The composite token serves multiple functions: it acts as both a service authentication credential and a user authorization carrier. This multi-functionality eliminates the need for separate validation processes for service tokens and user tokens, reducing system complexity while maintaining comprehensive security checks.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If user token is passed to called service, then user authorization can be validated, but security risks from token exposure increase

Engineering Contradiction:

Improveauthorization awarenessVSAvoidtoken impersonation risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

By combining service and user tokens into a single composite token with a unified structure, the system ensures that user authorization information is embedded within a token that also proves service identity. This prevents token impersonation attacks because the called service validates the composite token as a whole, ensuring both service authenticity and user authorization are verified together.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS20230275893A1Extending oidc authentication to service account for dual authorization

Publication Date: 2023.08.31 DELL PROD LP

AI summary

One example method includes receiving, by an identity and access management module, a request from a first service to validate a user token, and the request includes a service token. The method further includes performing, by the identity and access management module, a validation process on the user token and, when the validation process is successful, generating, by the identity and access management module, an access token that includes the user token and the service token. Finally, the method includes transmitting, by the identity and access management module to the first service, the access token, wherein the access token is usable by the first service to gain access to a second service upon successful validation, by the second service, of the access token.