Secure Access Token Structure for Encrypted JWT Payloads
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access tokens, such as JSON Web Tokens (JWTs), face security deficiencies due to insufficient encryption of sensitive data, impractical key management in asymmetric encryption systems, and limitations in compatibility across different computing platforms.
Innovation Solution
A modified JSON Web Encrypted Signed (JWES) token structure that allows partial encryption of data payloads, enabling secure communication across trust boundaries by encrypting sensitive data while maintaining compatibility with existing JSON Web Signature (JWS) formats, offloading decryption to a trusted token issuer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If JWTs are used for access tokens, then the tokens are compact and easily extractable, but they do not provide sufficient security for sensitive information
Solution Approach 1:
The patent applies local quality by selectively encrypting only the sensitive data portions of the token payload while leaving other non-sensitive information in plaintext. This allows the token to maintain its compact structure and ease of extraction while providing targeted security protection for sensitive information fields.
Solution Approach 2:
The patent segments the token payload into sensitive and non-sensitive portions, applying different security treatments to each segment. The sensitive data is encrypted using a content encryption key, while non-sensitive data remains accessible in plaintext, thus balancing security requirements with operational convenience.
2Reliability
If JWS is used for authentication, then the tokens can be verified with signatures, but the data is not encrypted and may be visible to others
Solution Approach 1:
The patent merges JWS and JWE mechanisms into a hybrid approach. The token structure combines digital signature verification (from JWS) with selective field encryption (from JWE), allowing both authentication verification and data confidentiality to coexist in a single token format.
Solution Approach 2:
The patent creates a composite security structure by layering encryption over the signed token. The underlying JWS provides authentication integrity, while the added encryption layer protects sensitive data from unauthorized viewing, creating a multi-layered security composite.
3Reliability
If JWE is used to encrypt sensitive data, then security is improved, but key management becomes complex when the same token is consumed by various backend systems
Solution Approach 1:
The patent introduces a content encryption key (CEK) as an intermediary that mediates between the symmetric encryption requirement and asymmetric key distribution. The CEK is encrypted with each backend system's public key, allowing multiple systems to decrypt the same encrypted data without directly sharing private keys, thus simplifying key management while maintaining security.
Solution Approach 2:
The patent adds a dimensional layer to key management by introducing a separate content encryption key that is distinct from the authentication signing keys. This additional dimension allows the system to use symmetric encryption for data protection while managing keys through asymmetric cryptography, separating the concerns of authentication and confidentiality.
4Reliability
If asymmetric encryption is used with multiple backend systems, then security is improved, but the same token needs to be encrypted with multiple public keys which is impractical
Solution Approach 1:
The patent uses a content encryption key as an intermediary that eliminates the need to encrypt the same token multiple times with different public keys. The single CEK encrypts the sensitive data once, and each backend system receives the same encrypted payload, which they can independently decrypt using their respective private keys after the gateway decrypts it with the appropriate key.
Solution Approach 2:
Instead of encrypting the token separately for each backend system with different public keys, the patent inverts the approach by using a single symmetric key to encrypt the data once, then managing access to that encrypted data through asymmetric key pairs at the decryption stage rather than the encryption stage.
Data Source
AI summary
Methods and apparatuses are described herein for improved communications between a service and end devices via a gateway. A token may be in a signed encrypted state when sent to untrusted devices and may be signed, but not encrypted, when used by trusted devices. Untrusted devices may receive the encrypted token and may use it to access services. An untrusted device may send the received encrypted token to the gateway, which may then send the token to its issuer so that the token issuer may decrypt the data payload. The token may then be sent back to the gateway, which may then read the decrypted data and verify whether the untrusted device is permitted to access the requested service. The gateway may then send, within the trusted domain, the request and token to the service provider so that the untrusted device can obtain access to the requested service.