Protected Forwarded Access Tokens for Web Service Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed systems, security issues arise when web services interact with each other due to the vulnerability of standard OBO tokens to replays and forwarding attacks, making it difficult to ascertain user consent and verify token validity across multiple connected services.
Innovation Solution
The implementation of protected forwarded access tokens, which involve a user token and an actor token, where the first service transforms and validates the user token, generates an authentication token signed with a private key, and provides it to the target service for validation, ensuring the actor token's validity and trustworthiness, and reducing network traffic by allowing actor tokens to be reused within their valid lifetime without additional identity provider requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If standard OBO tokens are used for web service interactions, then service-to-service communication is enabled, but the system becomes vulnerable to replay attacks and forwarding attacks
Solution Approach 1:
The patent segments the authentication process into multiple components: user tokens for user identification, actor tokens for service identity, and wrapped tokens that combine both. This segmentation allows each token type to have specific security properties, with wrapped tokens providing enhanced protection against replay and forwarding attacks by binding the actor token to the user token in a secure manner
Solution Approach 2:
The patent introduces wrapped tokens as an intermediary mechanism between standard OBO tokens and the target service. The wrapped token acts as a mediator that provides additional security layers, enabling the system to maintain service interaction capability while protecting against security vulnerabilities through the intermediate wrapping and validation process
2Reliability
If actor tokens are refreshed for each request to ensure security, then token validity is maintained, but network traffic and processing overhead increase
Solution Approach 1:
The patent implements preliminary action by obtaining actor tokens in advance and wrapping them with user tokens before target service requests. The actor tokens are obtained once per user session rather than for each individual request, and the wrapping process caches the security context. This allows subsequent requests to reuse the wrapped token structure without repeated identity provider calls, maintaining security while reducing overhead
Solution Approach 2:
The patent enables continuity of useful action by allowing wrapped tokens to be reused for multiple sequential requests to the target service within a session. Once the actor token is obtained and wrapped with user credentials, this combined security context can be reused across multiple requests without regenerating tokens, maintaining continuous secure communication while reducing repetitive authentication overhead
Data Source
AI summary
Methods for hardening security between web services using protected forwarded access tokens are implemented via systems and devices. User applications receive user tokens with user information from an identity provider and provide the user tokens to first services with data requests. Each first service extracts and transforms a portion of a user token to validate a user token signature, and determines a target service for the data request. The first services acquire actor tokens from the identity provider that uniquely identify the first services using public keys, and then generate authentication tokens, signed with corresponding private keys, that encapsulate the actor tokens and the transformed user tokens. The signed authentication tokens are provided to target services which validate the authentication tokens as well as the encapsulated tokens and their respective signatures. Upon validation, requested data is retrieved and provided back for the user applications from the target services.