OAuth Refresh Token Encryption in Browser Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current OAuth authentication methods lack secure storage solutions for refresh tokens in browser storage, making them vulnerable to unauthorized access due to the absence of encryption features, which compromises data security and increases the risk of brute force attacks.
Innovation Solution
The proposed solution involves encrypting the OAuth refresh token using a user-provided passcode and a private key generated by the service provider, storing the encrypted token locally in the browser, and requiring the passcode for decryption, thereby enhancing data security and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If OAuth refresh tokens are stored in browser storage without encryption, then ease of operation is improved (no additional authentication steps), but data security deteriorates (vulnerable to unauthorized access and brute force attacks)
Solution Approach 1:
The system performs preliminary encryption of the refresh token using a key derived from the user's passcode before storing it in browser storage. This preliminary action ensures that even if the storage is compromised, the token remains secure without requiring additional authentication steps at the time of storage.
Solution Approach 2:
The patent introduces an intermediary encryption layer between the refresh token and the browser storage. The encryption key, derived from the user's passcode through a key derivation function, acts as a mediator that protects the token while allowing convenient access when the user provides their passcode during authentication.
2Reliability
If refresh tokens are encrypted and stored securely, then data security is improved (protection against brute force attacks), but device complexity increases (encryption operations and key management)
Solution Approach 1:
The system implements self-service by allowing the user to provide their passcode, which automatically generates the encryption key through a key derivation function. This eliminates the need for complex key management infrastructure while maintaining strong security, as the user themselves provides the authentication credential needed for encryption.
Solution Approach 2:
The patent transforms the storage approach by changing the parameter state of the refresh token from unencrypted plaintext to encrypted ciphertext. The encryption parameter is derived from the user's passcode, creating a secure stored state that can be decrypted only with the corresponding passcode, thereby improving security without requiring complex system architecture.
3Ease of operation
If encryption keys are stored on the client side, then ease of operation is improved (faster authentication), but data security deteriorates (risk of key compromise if device is lost)
Solution Approach 1:
The passcode serves as an intermediary between the user and the encryption key. Instead of storing the actual encryption key on the client side, the system stores only the passcode and uses a key derivation function to generate the key when needed. This intermediary approach ensures that even if the device is compromised, the encryption key cannot be extracted without the user's passcode.
Solution Approach 2:
The patent replaces the mechanical storage of encryption keys with a cryptographic key derivation mechanism. Instead of directly storing the key (mechanical approach), the system uses a passcode combined with a key derivation function to generate the key dynamically (cryptographic approach), thereby maintaining speed while improving security against device compromise.
Data Source
AI summary
Mechanisms and methods are provided for managing OAuth access in a database network system, and extending the OAuth flow of authentication to securely store the OAuth encrypted refresh token in the storage available with current browsers or any other non-secure storage on user system.