Banking API Request Validation With Per-Request MORF Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current application security systems for web-based and mobile banking applications rely on a single gateway module, which is a single point of failure, and are vulnerable to replay attacks due to session tokens remaining valid throughout the user session, failing to provide adequate security against fraudulent requests.
Innovation Solution
Implement a system that issues new session tokens, such as MORF tokens, for each request, requiring validation for every request, and utilizes multiple validation points to ensure secure communication between micro applications and APIs, including reverse proxies, validators, and proxy sidecars.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single gateway module is used for application security, then the system structure is simple, but the system becomes a single point of failure and reliability decreases
Solution Approach 1:
The patent divides the security validation system into multiple independent validation points distributed across different components (reverse proxy, validators, proxy sidecars). Each validation point operates independently, eliminating the single point of failure while maintaining overall system security functionality.
Solution Approach 2:
Different validation points are assigned specific security validation functions tailored to their locations in the system architecture. The reverse proxy handles initial request filtering, validators perform token verification, and proxy sidecars provide additional validation layers, with each component having specialized local functionality.
2Productivity
If session tokens remain valid throughout the user session, then authentication is efficient, but the system becomes vulnerable to replay attacks
Solution Approach 1:
The patent implements dynamic token validation where session tokens are not static but are actively validated and refreshed at multiple points throughout the user session. The validation process dynamically checks token freshness and validity at each validation point, preventing replay attacks while maintaining efficient authentication flow.
Solution Approach 2:
The system incorporates feedback mechanisms where validation results from each validation point are used to determine whether to allow or block requests. Invalidated tokens provide feedback that triggers security responses, while valid tokens enable continued access, creating a feedback-driven security validation system.
3Loss of time
If full authorization is performed only at the start of the user session, then the validation process is fast, but security is insufficient for subsequent requests
Solution Approach 1:
The system performs preliminary validation actions at the reverse proxy and validator layers before requests reach the core application. These preliminary checks include token verification and freshness validation, which prevent insecure requests from proceeding while allowing authorized requests to pass through quickly.
Solution Approach 2:
The patent implements partial validation at different layers - the reverse proxy performs basic request filtering, validators perform token verification, and proxy sidecars provide additional validation. This layered approach provides excessive validation coverage that ensures security while minimizing the impact on request processing time through parallel processing.
Data Source
AI summary
Systems and methods for application security improvements are provided. The systems and methods may receive a banking request, including a request header, from a web browser or mobile application. Thereafter, a session cookie may be extracted from the request header. The session cookie may include one or more of a CSRF token, a MORF token, and a JWT. Thereafter, an outer API may validate the one or more tokens and create a validated banking request object. Upon such validations, a financial institution's APIs may allow a banking request to proceed with a high degree of confidence that the request is free of interference by bad actors and fraud. The validated banking request object may be transmitted to an inner API to accomplish the banking request. Thus, the system and methods described herein provide an improved system for application security, which decreases rates of fraud below that of known systems.