Secure Token Exchange for Cross-Service Sensitive Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing tokenization techniques are limited by the fact that tokens are only meaningful to the token-originating system, leading to security vulnerabilities when client applications need to provide sensitive information to systems other than the token-originating system, exposing the sensitive information to nefarious third parties.
Innovation Solution
Implementing a secure token exchange mechanism that allows client applications to send tokens to a secure token exchange service, which retrieves sensitive information directly from the token-originating system, avoiding exposure of the sensitive information to the client application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a client application requests sensitive information from a token-originating system using a token, then the sensitive information can be provided to another service, but the sensitive information is exposed to the client application and transmitted over the network, creating security vulnerabilities
Solution Approach 1:
The patent introduces a secure token exchange service as an intermediary between the client application and the token-originating system. The client sends the token to this intermediary service, which then retrieves the sensitive information directly from the token-originating system using the token. This intermediary mechanism allows the client to obtain sensitive information from other services without the information being exposed to the client application or transmitted over the network, thus resolving the contradiction between adaptability and security.
2Adaptability or versatility
If the client application directly receives and transmits sensitive information, then other services can access the information, but the information transmission creates security risks
Solution Approach 1:
The patent extracts the sensitive information retrieval operation from the client application and relocates it to the secure token exchange service. The client application only handles tokens, which are meaningless without the token-originating system. The extraction of the sensitive information retrieval process eliminates the security risk of transmitting sensitive information over the network while maintaining the ability for services to access the information through the secure intermediary.
3Reliability
If tokens are only meaningful to the token-originating system, then security is maintained, but the client application cannot provide the represented sensitive information to other services
Solution Approach 1:
The secure token exchange service acts as a mediator that bridges the gap between token security and service interoperability. It accepts tokens from client applications, validates them with the token-originating system, retrieves the corresponding sensitive information, and provides it to requesting services. This intermediary approach maintains the security benefits of tokenization while enabling adaptability across multiple services.
Data Source
AI summary
Techniques provided for using a secure token exchange between services that require access to the same sensitive information. Using the techniques, a client application may send a token provided by a first service to second service in order for the second service to obtain, directly from the first service, the sensitive information that corresponds to the token. Because the sensitive information is not sent from the first service to the client application, and from the client application to the second service, security vulnerabilities are avoided.