OAuth 2.0 Multi-Instance Token Generation via Network Address
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
OAuth 2.0 does not effectively manage secure third-party access across multiple instances of an application replicated across machines within a single customer's server farm or cluster, lacking a standardized method for issuing and validating access tokens.
Innovation Solution
Modifying the OAuth 2.0 standard to assign a single application identifier and secret to replicated applications, with a secure access service issuing distinct access tokens and validating requests from multiple instances, utilizing a hash function to generate tokens based on the application ID, secret, and network address.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If OAuth 2.0 is used for authorization, then secure delegated access is provided, but it cannot effectively manage access across multiple replicated application instances
Solution Approach 1:
The patent segments the authorization management by introducing instance-specific identifiers (network address or instance ID) that differentiate multiple replicated application instances. Each instance receives a distinct access token incorporating its unique identifier, enabling the authorization system to manage and track access rights for each instance separately while maintaining overall security through the standardized OAuth 2.0 framework.
2Adaptability or versatility
If multiple access tokens are issued for replicated applications, then secure access is enabled, but the OAuth 2.0 standard lacks a standardized method for token issuance and validation
Solution Approach 1:
The patent extends the OAuth 2.0 authorization mechanism to serve multiple replicated application instances through a universal token issuance process. The authorization server incorporates the instance identifier into the access token generation and validation process, allowing a single standardized procedure to handle both single-instance and multi-instance scenarios without requiring separate authorization workflows.
Solution Approach 2:
The patent introduces an authorization server as an intermediary that mediates between the replicated application instances and the protected resources. This intermediary manages the complex token issuance and validation processes, incorporating instance identifiers into tokens and ensuring proper authorization decisions, thereby shielding the application instances from the complexity of multi-instance authorization management.
3Ease of operation
If a unified application identifier is used for replicated applications, then simplified registration is achieved, but differentiation between instances is lost
Solution Approach 1:
The patent applies local quality by maintaining a unified application identifier for the application as a whole while introducing instance-specific identifiers (network address or instance ID) at the local level of each replicated instance. This allows simplified registration at the application level while enabling precise differentiation and identification at the instance level through the incorporated instance-specific information in access tokens.
Data Source
AI summary
An authenticating device assigns an application identifier and an application secret value to a customer application, receives a first resource authorization request from a first instance of multiple replicated instances of a customer application, where the first instance is installed in a first machine, and receives a second resource authorization request from a second instance of the multiple replicated instances of the customer application, where the second instance is installed in a second machine. The authenticating device generates, responsive to the first resource authorization request, a first token using a first network address associated with the first machine, the application identifier and the application secret value, and returns, to the first instance of the customer application, the generated first token for use in requesting access to a resource server.