Offline Job Access Token Decoupling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional OAuth2 protocols face significant processing overhead and complexity in managing refresh tokens for offline processing, especially when dealing with large numbers of users, due to the need for frequent rotation and management of access tokens, which complicates concurrent processing and security.
Innovation Solution
A method and system that register an API and operation with an offline job, obtain user consent, create an access token including the operation and API, and store user consent separately from the access token, allowing the offline job to use the access token to perform security-sensitive operations without managing user consents or access tokens, thereby reducing complexity and overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OAuth2 protocol is used for offline processing, then secure delegated access is provided, but processing overhead increases significantly
Solution Approach 1:
The patent segments the authentication process by separating long-lived user consent (stored in repository) from short-lived access tokens (created on-demand). This allows offline jobs to obtain tokens without managing full OAuth2 credential sets, reducing processing overhead while maintaining security.
Solution Approach 2:
The patent introduces a runtime manager as an intermediary between offline jobs and the OAuth2 authorization server. The runtime manager handles token creation and management, shielding offline jobs from complex OAuth2 protocols and reducing their processing burden while maintaining secure access.
2Reliability
If refresh tokens are frequently rotated for security, then security is improved, but concurrent processing becomes challenging due to race conditions
Solution Approach 1:
The patent extracts the token rotation and invalidation logic from individual offline job instances and centralizes it in the runtime manager. The runtime manager coordinates token creation and invalidation across multiple concurrent jobs, eliminating race conditions while maintaining security through controlled token lifecycle management.
Solution Approach 2:
The patent implements feedback mechanisms where the runtime manager tracks token usage and validity across concurrent offline jobs. When tokens are rotated or invalidated, the runtime manager propagates this information to all relevant jobs, ensuring consistent security state without requiring jobs to independently manage token rotation logic.
3Reliability
If access tokens include operation and API information, then scope is restricted and security is improved, but token management complexity increases
Solution Approach 1:
The patent makes access tokens self-descriptive by embedding operation and API scope information directly in the token structure. This allows the tokens to carry their own validation information, reducing the need for external token management complexity while maintaining restricted scope for security.
Data Source
AI summary
A method may include registering, with an offline job to be executed by a computer processor, an application programming interface (API) and an operation, obtaining, from a repository, a user consent of a user for the operation, and in response to obtaining the user consent, creating, for the user, an access token including the operation and the API. The user consent may be stored external to the access token. The method may further include transmitting the access token to the offline job, and calling, by the offline job, the API using the access token.