Dual Binding for Bidirectional OAuth 2.0 Token Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Single Sign-On services do not allow bidirectional sharing of user information between different entities, requiring users to manually grant permissions separately for each direction, which is cumbersome and lacks seamless technical implementation.
Innovation Solution
A dual binding system that synchronizes user account identities across multiple network entities, allowing bidirectional consent and token exchange using OAuth 2.0 protocol for seamless access and revocation of user data between entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If Single Sign-On services are used to allow users to access multiple accounts with a single credential, then user convenience is improved, but the ability for entities to communicate and share user information is lost
Solution Approach 1:
The system segments the authentication and information sharing processes into distinct OAuth 2.0 flows. One flow handles initial authentication and grants access tokens, while a separate binding flow enables bidirectional information sharing. This segmentation allows Single Sign-On to function for authentication while enabling optional information exchange through the binding mechanism.
Solution Approach 2:
The patent introduces an intermediary binding mechanism that mediates between the Single Sign-On authentication system and the information sharing requirement. The binding process creates synchronized access grants between entities, acting as an intermediary that enables confidential information exchange while maintaining the security framework of Single Sign-On.
2Adaptability or versatility
If bidirectional information sharing between entities is enabled, then user data accessibility is improved, but the complexity of consent management increases
Solution Approach 1:
The patent merges the consent management processes of bidirectional access into a single unified binding operation. Instead of requiring separate consent flows from each entity, the system combines them into one synchronized process where both entities grant access simultaneously through a single user action, reducing consent management complexity.
Solution Approach 2:
The system implements feedback mechanisms where entities receive notifications and status updates about binding operations. The synchronized access grant system provides feedback loops that automatically manage consent states, reducing the manual complexity of tracking and managing bidirectional permissions across multiple entities.
3Reliability
If separate login and permission granting is required for each entity, then data security is maintained, but user time and operational efficiency are reduced
Solution Approach 1:
The patent implements preliminary action by pre-establishing binding relationships between entities through a single user consent action. Once bound, the system automatically manages subsequent access requests using pre-configured OAuth 2.0 flows, eliminating the need for users to repeatedly log in and grant permissions to already-bound entities, thus saving time while maintaining security.
Solution Approach 2:
The system enables self-service by automatically managing authentication and permission granting for bound entities. Once the binding is established, the OAuth 2.0 framework handles subsequent access tokens, refresh tokens, and permission validations automatically without requiring user intervention, reducing operational time while maintaining data security through automated security protocols.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In an example, an action is received in a user interface that necessitates access of data, corresponding to the user, stored by a second network entity distinct from a first network entity. A combined consent screen is then displayed, the combined consent screen including a button which, when activated in the user interface, authorizes data corresponding to the user to be exchanged in both directions between the first network entity and the second network entity. In response to the receiving of the indication that the button has been activated, a first access grant is generated at the first network entity and sent to the second network entity. An exchange of authorization code is received from the second network entity. A first access token corresponding to the first access grant is generated and sent to the second network entity. A second access token corresponding to a second access grant is received.