Reverse Proxy Token Substitution for SSO Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
OAuth 2.0 security exploits in cloud-based authentication infrastructure expose sensitive information, such as access tokens, leading to security risks and non-compliance with regulatory schemes like GDPR.
Innovation Solution
Implementing a system with first and second reverse proxies that operate within a trusted security environment to monitor and substitute access tokens with random strings, ensuring that access tokens are never exposed to untrusted client environments, thereby protecting sensitive information during Single Sign-On (SSO) processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access tokens are transmitted in clear text or base64-encoded format through cloud-based authentication infrastructure, then the SSO protocol can be implemented straightforwardly, but sensitive information including PII becomes exposed to interception and decryption by malicious actors
Solution Approach 1:
The patent introduces a proxy server as an intermediary component positioned between the authentication server and the client. This proxy intercepts the authorization response containing the access token, extracts the token, and forwards only a placeholder or modified response to the client. The proxy acts as a mediator that prevents the access token from reaching the untrusted client environment while maintaining the appearance of a normal SSO flow.
Solution Approach 2:
The patent extracts the access token from the authorization response before it can be transmitted to the client. The proxy server identifies and removes the access token from the response payload, separating it from the data that would be sent to the client. This extraction prevents the token from being exposed in the client's untrusted environment while allowing the rest of the authorization flow to continue.
2Difficulty of detecting and measuring
If access tokens are intercepted and decrypted by proxies in untrusted environments, then the protocol flow can be monitored, but security compliance with regulations like GDPR is violated due to exposure of PII
Solution Approach 1:
Instead of allowing the proxy in the untrusted environment to intercept and decode the access token, the patent inverts the approach by having the trusted proxy send a modified response that excludes the token entirely. The client receives an authorization response without the access token, eliminating the security vulnerability while maintaining the functional flow of the SSO protocol.
Solution Approach 2:
The patent applies preliminary anti-action by preventing the access token from being transmitted to the client in the first place. The proxy server proactively removes the token from the authorization response before it can be exposed to the untrusted client environment, thereby preventing the potential security exploit before it can occur.
3Object-affected harmful factors
If reverse proxies substitute access tokens with random strings, then sensitive information is protected from client exposure, but the system complexity increases due to additional monitoring and substitution mechanisms
Solution Approach 1:
The patent employs reverse proxies as intermediary components that sit between the authentication server and the client. These proxies automatically intercept authorization responses, perform token substitution with random strings, and forward the modified responses to clients. This intermediary approach protects sensitive information while automating the complexity management through standardized proxy mechanisms.
Solution Approach 2:
The patent creates a copy of the authorization response and modifies it by replacing the access token with a random string before forwarding to the client. The proxy maintains the structural integrity of the response while substituting the sensitive token portion, allowing the client to receive a valid-looking response without the actual token.
Data Source
AI summary
A method to protect sensitive information during a single sign-on (SSO) process flow initiated from a client and directed to an authorization server configured to issue an access token upon verification of a credential. The technique leverages a first proxy that monitors a packet flow issued from the authorization server, and a second proxy that monitors a redirect packet flow issued from the client (in response to the packet flow). A message that includes the access token is modified by the first proxy to include a data string, and the modified message is delivered to the client; concurrently, the first proxy provides the data string/access token pair to the second proxy. When the client receives the modified message, it issues a response (that includes the data string) back to a resource server. As the response traverses the second proxy, it removes the data string and re-inserts the access token, and the resulting modified response is forwarded to the resource server.