Hybrid App Persistent Login via Refresh Token Segmentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Hybrid applications face challenges in supporting persistent login and multilogin due to the expiration of authentication cookies, which complicates user authentication and hinders push notifications, as access tokens alone cannot authenticate web application portions and non-expiring cookies pose security risks.

Innovation Solution

The system obtains an access token and refresh token using user credentials, stores the refresh token in persistent storage, and exchanges the access token for a browser authentication cookie to authenticate the web application portion of a hybrid application, allowing for persistent login and multilogin capabilities without relying on non-expiring cookies.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If authentication cookies are set to expire upon closing the browser, then security is improved, but persistent login capability deteriorates

Engineering Contradiction:

ImprovesecurityVSAvoidpersistent login capability

Core Design Contradiction:

ReliabilityVSDuration of action of moving object

Solution Approach 1:

The patent segments the authentication mechanism into two distinct components: short-lived authentication cookies that expire for security, and long-lived refresh tokens stored in persistent storage that enable automatic token renewal. This segmentation allows the system to maintain both security (through expiring cookies) and persistent login capability (through refresh tokens that can be exchanged for new cookies without user intervention).

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The refresh token acts as an intermediary between the user's initial authentication and the persistent login state. Instead of relying on the authentication cookie alone to maintain login state, the system introduces a refresh token that can be used to obtain new authentication cookies, thereby mediating between security requirements (cookie expiration) and persistent access requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Duration of action of moving object

If non-expiring cookies are used to support persistent login, then persistent login capability is improved, but security deteriorates

Engineering Contradiction:

Improvepersistent login capabilityVSAvoidsecurity

Core Design Contradiction:

Duration of action of moving objectVSReliability

Solution Approach 1:

The patent divides the authentication state into two segments with different expiration characteristics: authentication cookies that expire to maintain security, and refresh tokens in persistent storage that do not expire to maintain persistent login capability. This segmentation eliminates the need for non-expiring cookies while achieving the same persistent access goal.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The authentication cookie is designed as a short-lived, disposable object that expires after use or after a set period, forcing re-authentication or token refresh. This approach replaces the need for long-lived, secure cookies with a combination of short-lived secure cookies and long-lived refresh tokens, achieving both security and persistence.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Adaptability or versatility

If access tokens are used alone for authentication, then push notifications are supported, but web application portion authentication deteriorates

Engineering Contradiction:

Improvepush notifications supportVSAvoidweb application authentication

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent implements a universal authentication mechanism where the refresh token serves multiple functions: it enables push notifications by maintaining a persistent authenticated state with the authentication server, and it simultaneously enables web application portion authentication by being exchangeable for authentication cookies that the web portion can use. This multi-functionality resolves the contradiction between supporting push notifications and authenticating the web application.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Adaptability or versatility

If multiple user credentials are stored for multilogin, then multilogin capability is improved, but device complexity deteriorates

Engineering Contradiction:

Improvemultilogin capabilityVSAvoidauthentication management

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent segments the multilogin implementation by storing only refresh tokens in persistent storage for each user account, rather than storing complete authentication states or cookies. This segmentation simplifies the device's authentication management while enabling multilogin, as the system only needs to manage lightweight refresh tokens that can be exchanged for user-specific authentication cookies when needed.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS9178868B1Persistent login support in a hybrid application with multilogin and push notifications

Publication Date: 2015.11.03 GOOGLE LLC

AI summary

A system and method are disclosed that may allow a hybrid application to support persistent login, multilogin, and push notifications. User credentials may be received and utilized to obtain an access token and a refresh token. The refresh token may be stored to persistent storage and the access token may be used to obtain a browser authentication cookie from an authentication server. The web application portion of a hybrid application may be authenticated using the browser authentication cookie.