Origin Isolation for Secure Access Token Management

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Browser-based single page applications (SPAs) are vulnerable to cross-site scripting (XSS) attacks, which allow malicious code to access and exploit access tokens, compromising user credentials and sensitive information.

Innovation Solution

Implementing origin isolation to securely manage access tokens by storing them in a separate origin and using a postMessage function to make requests to resource servers without direct access, ensuring that even if a malicious app is injected, it cannot read the access token.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If access tokens are stored directly in the browser-based application, then the application can easily make credentialed network requests, but the tokens become vulnerable to XSS attacks and malicious code access

Engineering Contradiction:

Improveease of making credentialed requestsVSAvoidvulnerability to XSS attacks

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent divides the application into two separate origins: the main application code and the secrets management proxy. The access tokens are stored in the proxy's isolated storage, which is inaccessible to the main application code due to browser-enforced same origin policy. This segmentation prevents malicious code in the main application from accessing tokens while still allowing credentialed requests to be made through the proxy.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The secrets management proxy acts as an intermediary between the main application and the resource server. The proxy holds the access tokens and makes credentialed requests on behalf of the application, eliminating the need for the application to directly access or store tokens. This intermediary approach maintains security while enabling authenticated communication.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If access tokens are stored in isolated storage inaccessible to the application code, then security against XSS attacks is improved, but the application cannot directly access the tokens for making requests

Engineering Contradiction:

Improveprotection from malicious codeVSAvoidaccess to credentials for requests

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The secrets management proxy serves as the intermediary that bridges the gap between security isolation and operational need. It stores tokens in isolated storage inaccessible to the application, yet can retrieve and use them to make credentialed requests to resource servers, thus satisfying both security requirements and functional needs.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The secrets management proxy autonomously manages the access tokens - retrieving them from isolated storage, attaching them to requests, and communicating with resource servers. The main application doesn't need to directly access or manage tokens, as the proxy handles these tasks independently while maintaining security boundaries.

Inventive Principle:

Principle #25Self-service

3Productivity

If the application directly manages access tokens, then request handling is simple and direct, but the application becomes a target for credential theft and exploitation

Engineering Contradiction:

Improveefficiency of request handlingVSAvoidsecurity of credentials

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

By segmenting the system into application code and secrets management proxy running in separate origins, the patent removes the security risk from the application while maintaining request handling efficiency through the proxy. The proxy manages tokens securely in isolated storage and handles all credentialed communications.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The secrets management proxy intermediates all credentialed requests, taking over the task of token management from the application. This allows the application to focus on business logic while the proxy handles security-sensitive operations, improving both reliability and overall system efficiency.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11689528B2Transparently using origin isolation to protect access tokens

Publication Date: 2023.06.27 PING IDENTITY INT INC

AI summary

The disclosed technology teaches safely attaching an access token to a browser-based request from a first app loaded by a webpage, without exposing the token to malicious code loaded by the webpage, providing an identity proxy that transparently determines which network requests to relay and a secrets management proxy that provides access tokens transparently to the requests. The identity proxy intercepts an access request from the first app to the resource server and relays the request via the secrets management proxy, which forwards the request to the resource server with an access token, receives a response from the resource server and forwards the response to the identity proxy for return to the first app. The secrets management proxy is implemented in an iFrame that has isolated storage subject to a browser-enforced same origin policy that makes the isolated storage used by the iFrame inaccessible to malicious code on the webpage.