Ephemeral Authorization Tokens for Encrypted Partner Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity standards and authentication protocols do not provide sufficient confidentiality for authentication tokens, exposing them to security risks and unnecessary exposure due to longer expiration times.
Innovation Solution
Generate ephemeral authorization tokens from partner tokens, encrypting them with resource-specific and federated identity/authentication provider encryption, and setting shorter expiration times to enhance security and confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication tokens are exposed in HTTP URL or header for partner resource access, then message integrity is provided, but confidentiality is compromised
Solution Approach 1:
The patent embeds the partner authentication token within an ephemeral authorization token structure. The ephemeral token contains the partner token as a nested component along with additional security layers including expiration timestamps and cryptographic signatures, creating a multi-layered authentication mechanism that protects the inner token while maintaining its functionality
Solution Approach 2:
The patent introduces an ephemeral authorization token as an intermediary between the partner authentication server and the protected resource. This intermediate token acts as a mediator that carries the necessary authentication information without exposing the original partner token, thereby maintaining confidentiality while enabling resource access
2Duration of action of moving object
If authentication tokens have longer expiration times, then resource access is maintained, but security exposure increases due to replay attacks
Solution Approach 1:
The patent implements dynamic expiration times for ephemeral authorization tokens based on the specific resource being accessed. Each ephemeral token receives a context-appropriate expiration duration that is sufficient for the resource access operation but limited enough to minimize replay attack window, creating a dynamic security posture that adapts to different access scenarios
Solution Approach 2:
The patent pre-establishes expiration timestamps and cryptographic signatures within the ephemeral authorization token during its creation phase. By preliminarily setting these security parameters, the system ensures that the token has built-in expiration controls that automatically limit its validity period, preventing indefinite reuse and reducing replay attack risk before the token is even used
Data Source
AI summary
In a system that controls access to resources via tokens, a system includes an application that generates ephemeral authorization tokens from partner tokens, to increase confidentiality and security, in embodiments. Responsive to a request, received by an application provider, for a protected resource, a federated ID/authorization provider is caused to receive a request for access/ID tokens that the ID/authorization provider provides (in any of various ways) to the application. The application validates and stores the tokens, nests the access/ID tokens within an ephemeral token document having a unique ID and shortened expiration, encrypts the nested ephemeral token using at least resource-specific encryption and causes the encrypted nested token to be sent to the protected resource provider that decrypts and validates the ephemeral token, causes the Access/ID token(s) within the ephemeral token to be validated, and provides the protected resource for valid tokens.