Partial Cookie Authentication for Secure Seamless Authorization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Full-data cookies increase the risk of unauthorized access and misuse, compromising security while providing seamless authentication.

Innovation Solution

Implementing partial cookies that store limited user data, allowing secure and efficient access to user profiles without requiring full authentication information, and transitioning to full cookies based on device trust levels.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If full-data cookies are used to provide seamless authentication, then ease of operation is improved, but security is worsened due to increased risk of unauthorized access and misuse

Engineering Contradiction:

Improveseamless authenticationVSAvoidsecurity

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent segments the authentication cookie into two distinct types: session cookies for temporary access and authentication cookies for verified users. This segmentation allows the system to provide seamless authentication for recognized users while maintaining security by requiring full authentication verification before issuing authentication cookies, thus resolving the contradiction between ease of operation and security.

Inventive Principle:

Principle #1Segmentation

2Ease of operation

If extensive user data is stored in cookies for customization, then ease of operation is improved, but the risk of unauthorized access and misuse increases

Engineering Contradiction:

Improveuser customizationVSAvoidunauthorized access risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent applies local quality by storing different types of user data in different locations with different access permissions. Session cookies store minimal identifying information locally for customization, while sensitive authentication data is stored securely on the server. This allows user customization through local data while minimizing the security risk of storing extensive data locally.

Inventive Principle:

Principle #3Local quality

3Reliability

If cookies are transmitted correctly and at the right time for secure access, then reliability is improved, but device complexity increases due to transmission timing requirements

Engineering Contradiction:

Improvesecure accessVSAvoidtransmission timing control

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by establishing cookie transmission rules in advance through server configuration. The server is pre-programmed with logic to issue session cookies at specific events (e.g., account creation, failed authentication attempts) and authentication cookies only after successful verification. This preliminary setup simplifies the actual transmission process by automating timing decisions based on pre-defined conditions, resolving the contradiction between reliability and device complexity.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12621285B2Systems and methods for using partial cookies for electronic authentication and authorization

Publication Date: 2026.05.05 STRIPE LLC

AI summary

The methods and systems disclosed herein allow for faster and more efficient authentication using a partial cookie instead of a full cookie (or other data structure). In one example, a server receives, during the first browser session at the first time, a first request for authorization from an electronic device along with authentication information. Responsive to generating a profile using the authentication information, the server transmits to the electronic device a first data source configured to grant access to the profile to the electronic device, via a first authentication protocol; and receives, at a second browser session at a second time, from the electronic device, a second request for authorization to access the profile; responsive to a determination that the electronic device includes the first data source, the server executes a secondary authentication protocol.