Mobile App Inter-App Communication via Server Session Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for transferring patient health data between applications on a mobile computing device are insecure, as they often require a third-party broker, shared security subsystems, or exposure to the operating system, which are undesirable and insufficiently secure.
Innovation Solution
A system where a client emitter application on a mobile device securely transfers data to a client consumer application by using a server-based authentication process, generating session tokens, and performing programmatic calls, without the need for a third-party broker or shared security subsystems, thereby maintaining data security and avoiding exposure to the operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a third-party broker application is installed to transfer data between applications, then data transfer capability is enabled, but security is compromised and device complexity increases
Solution Approach 1:
The patent extracts the security-critical authentication logic from the mobile device and relocates it to a remote server. The server generates and manages session tokens, while the mobile device only performs token validation. This extraction eliminates the need for third-party broker applications on the device, maintaining security while enabling data transfer between applications.
Solution Approach 2:
The patent introduces session tokens as an intermediary mechanism between applications. Instead of direct application-to-application communication or reliance on broker applications, the token acts as a secure mediator that carries authentication information. The token is generated by the server and validated by the consumer application, enabling secure data transfer without exposing sensitive data or requiring additional applications on the device.
2Ease of operation
If a common security subsystem with shared keys is used between applications, then authentication is simplified, but adaptability decreases and device complexity increases
Solution Approach 1:
The patent creates a universal authentication mechanism where session tokens can be used across different applications and developers. The server-generated token system provides a common authentication framework that works between any emitter and consumer applications registered with the server, eliminating the need for applications to be developed in tandem by a common developer while maintaining ease of authentication.
3Adaptability or versatility
If shared secured storage is used for access credentials, then data transfer is enabled, but security is compromised due to OS exposure
Solution Approach 1:
The patent extracts sensitive authentication credentials from the mobile device's shared storage system and relocates them to secure server-side storage. The device only stores non-sensitive session tokens that are validated locally, while the actual authentication credentials remain on the server. This extraction eliminates the security vulnerability of exposing credentials to the operating system's shared storage while maintaining data transfer capability.
4Reliability
If server-based authentication with session tokens is implemented, then data security is enhanced, but device complexity and processing requirements increase
Solution Approach 1:
The patent segments the authentication system into distinct functional components: the server handles token generation and credential management, while the mobile device handles token validation and data transfer. This segmentation places the complex authentication logic on the server, keeping the device-side implementation relatively simple while achieving enhanced security.
Data Source
AI summary
A computing system for inter-application communication between a client emitter application and a client consumer application executing on a mobile computing device is disclosed herein. The client emitter application receives an indication of a programmatic task to be performed by the client consumer application. The client emitter application transmits data to a server emitter application executing on a first server computing device causing a session token to be generated, the session token indicating that a server consumer application executing on a second server computing device has authenticated the client emitter application. The server emitter application forwards the session token to the client emitter application. The client emitter application includes the session token in a call indicative of the programmatic task to the client consumer application. The client consumer application and the server consumer application authenticate the client emitter application and the client consumer application, respectively, based on the session token. The client consumer application then performs the programmatic task.