Inter-Client Token Authorization for Secure Session Handover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity management systems struggle to securely transfer sessions between different clients, particularly between native applications and web applications, due to vulnerabilities in browser cookies and the inability to support non-web sessions, leading to security risks such as session hijacking.
Innovation Solution
The implementation of an inter-client token system that allows a user to perform a first authorization procedure at a source client, generating an identity token which is then used to create an inter-client token, enabling secure session transfer to a target client by providing proof of the first authorization procedure, even across different types of applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If browser cookies are used for session management, then session transfer between clients is enabled, but security vulnerabilities such as session hijacking occur
Solution Approach 1:
The patent extracts the session identification mechanism from browser cookies and relocates it to a server-side session store. The client receives only a session identifier without the actual session data, separating the lightweight identification function from the sensitive session information. This eliminates the security vulnerability of cookies while preserving session transfer capability.
Solution Approach 2:
The patent introduces an authorization server as an intermediary between clients and session management. The authorization server validates session identifiers, manages session state, and mediates session transfer between source and target clients. This intermediary layer provides secure session management without relying on vulnerable client-side cookies.
2Adaptability or versatility
If traditional identity management systems are used, then authentication services are provided, but session transfer between different client types (native and web applications) is not supported
Solution Approach 1:
The patent implements a universal session management system that works across different client types (native applications, web applications, mobile apps). The authorization server provides a common interface and session store that all client types can use, enabling seamless session transfer between heterogeneous clients while maintaining consistent security policies.
Solution Approach 2:
The patent segments the authentication system into distinct components: client applications, authorization server, session store, and protocol layer. This segmentation allows each component to be optimized for its specific function while working together through standardized interfaces, enabling cross-client session transfer without compromising security.
3Reliability
If cryptographic signatures and trust relationships are implemented between authorization servers, then session transfer security is enhanced, but system complexity increases
Solution Approach 1:
The patent uses cryptographic parameters (signing keys, trust relationships, token formats) to secure session transfer. By changing the parameter space to include cryptographic verification, the system achieves strong security guarantees. The complexity is managed by providing standardized cryptographic interfaces that abstract the underlying complexity from individual components.
Data Source
AI summary
A method for session handover via an inter-client token is described. The method may include performing a first authorization procedure to establish a first session for a user at a source client, the first authorization procedure being performed via a first authorization server. The source client may receive, from the first authorization server based on the first authorization procedure, an identity token including an identifier of the user and an indication of authentication methods associated with the first authorization procedure. The source client may transmit an inter-client token to a target client, where the inter-client token may be based on the identity token and usable for establishing a second session for the user at the target client. The target client may transmit the inter-client token to a second authorization server and establish, based on the inter client token, the session for the user via the second authorization server.