Encrypted Access Token for Secure API Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for accessing online resources expose user confidential information to attacks while in transit and at rest, as they often use unencrypted user credentials, which can be compromised by software bugs or malicious applications.
Innovation Solution
The use of encrypted access tokens, such as JSON Web Encryption (JWE) tokens, is implemented to secure user data, ensuring confidentiality and integrity both during transmission and storage, by encrypting user identifiers and binding them to user sessions, thus preventing exposure even if the client device is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user credentials including confidential information are stored on client device for access, then ease of operation is improved, but security is worsened due to exposure to attacks while in transit and at rest
Solution Approach 1:
The patent extracts the confidential information from the user credentials and stores it separately in an encrypted form in the data store, while the access token contains only a non-confidential user identifier. This separation allows the client device to store and transmit access tokens without exposing sensitive data, resolving the contradiction between ease of operation and security.
Solution Approach 2:
The patent introduces an encrypted access token as an intermediary between the user credentials and the resource access process. The token contains an encrypted version of the confidential information that can be stored and transmitted safely, allowing convenient access while maintaining security through the encrypted intermediary layer.
2Reliability
If encrypted access tokens are used to protect confidential information, then security is improved, but device complexity is worsened due to encryption and decryption operations
Solution Approach 1:
The patent performs the encryption of confidential information in advance when creating the access token, storing the encrypted form in the data store. This preliminary encryption action eliminates the need for real-time encryption during access operations, reducing device complexity while maintaining security.
Solution Approach 2:
The server performs the encryption and decryption operations autonomously without requiring complex client-side cryptographic processing. The client device simply stores and transmits the encrypted token, allowing the server to handle the cryptographic complexity, thus reducing overall device complexity while maintaining security.
Data Source
AI summary
Systems and methods for providing access to online content while also securing user confidential information are presented. User confidential information (e.g., user phone number or e-mail address) may be used to authenticate and authorize a client device to access online resources, such as microservices exposed via application programming interfaces (APIs). With the techniques described herein, such user confidential information is protected both in transit over a network connection and while at rest in storage on the client device. This is achieved through the use of an encrypted access token (e.g., a JSON Web Encryption (JWE) token) including the user confidential information in an encrypted form. The client device receives such encrypted access token from an identity provider (IDP) and passes it to a resource server API to access the microservices associated with the API, without the client device decrypting the user confidential information contained therein.