Self-Contained Refresh Token Security via Client-Specific Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for generating access tokens face inefficiencies and security risks due to the frequent regeneration of refresh tokens, which can lead to shorter lifetimes and increased security breaches if refresh tokens are stolen or leaked.
Innovation Solution
Implementing a method that uses a protected version of refresh tokens, encrypted with a client identifier, to securely generate new access tokens, allowing the refresh token to be used multiple times without regeneration, while maintaining secure authentication and authorization processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If refresh tokens are frequently regenerated to maintain security, then security against stolen or leaked tokens is improved, but the validity period of refresh tokens is reduced and token management complexity increases
Solution Approach 1:
The patent segments the refresh token into two parts: a public identifier and a private encrypted payload. The private payload is encrypted using the client's public key, creating a segmented structure where only the authorized client can access the token contents, enabling long validity without compromising security.
Solution Approach 2:
The patent introduces a public key infrastructure as an intermediary mechanism. The authorization server uses the client's public key to encrypt the refresh token payload, and the client uses its private key to decrypt it. This intermediary cryptographic mechanism enables secure long-term token storage without frequent regeneration.
2Productivity
If refresh tokens are used multiple times without regeneration, then productivity and efficiency are improved, but security risks increase if tokens are stolen or leaked
Solution Approach 1:
The patent applies local quality by encrypting the refresh token payload with the specific client's public key. This ensures that the token is uniquely tied to the client's identity and can only be decrypted by that client's private key, making stolen tokens useless to other entities while allowing multiple uses for the legitimate client.
Solution Approach 2:
The patent changes the parameter of token usability from single-use to multi-use by implementing cryptographic protection. The encrypted payload structure allows the same refresh token to be used multiple times for accessing different resources, improving efficiency while maintaining security through the client-specific encryption.
3Reliability
If access tokens are generated frequently to ensure security, then security is improved, but the time required for authentication increases
Solution Approach 1:
The patent implements preliminary action by having the client application prepare and encrypt the refresh token payload before use. The token is pre-encrypted with the client's public key during initial authentication, so that subsequent access requests can use the pre-prepared encrypted payload without requiring time-consuming re-authentication, thus reducing authentication time while maintaining security.
Data Source
AI summary
The present disclosure relates to computer-implemented methods, software, and systems for securely generating a new access token based on relatively long-lasting refresh tokens in self-contained format. A first request to generate a new access token for authorization of a client application with an application server is received and includes a first protected version of a refresh token. The first protected version of the refresh token is an encrypted version of the refresh token based on a first client identifier. The first protected version of the refresh token is decrypted to determine content of the refresh token based on a second client identifier of the client application that is externally invoked for validating the authorization. In response to successfully decrypting the first protected version, performing a validation of the refresh token. In response to successfully validating the refresh token, generating the new access token and providing it to the client application.