Sessionless Access Token Encryption for Resource Services

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The maintenance of communication sessions for accessing resources services is complex and resource-intensive, involving significant overhead in computing resources and network bandwidth due to the need for session establishment and management between customer devices, partner servers, and resource services.

Innovation Solution

Implementing session-less communications using access tokens that contain encryption keys, where the customer device requests an access token from a gateway, which validates and generates encryption keys, allowing end-to-end encryption without persisting session information or keys on the gateway, thereby reducing complexity and overhead.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If communication sessions are established and maintained for accessing resource services, then authentication and controlled access are achieved, but significant overhead in computing resources and network bandwidth is consumed

Engineering Contradiction:

Improveauthentication and controlled accessVSAvoidcomputing resources and network bandwidth

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

Authentication credentials are validated and session information is generated in advance before actual resource access occurs. The gateway performs preliminary authentication when the customer device first connects, storing session information that can be reused for subsequent resource access requests, avoiding repeated authentication overhead

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Instead of maintaining full session state information at multiple network entities, the patent uses session information that can be copied and shared selectively between the gateway, partner server, and customer device. This reduces the need for each entity to independently maintain complete session state, lowering overall computing resource consumption

Inventive Principle:

Principle #26Copying

2Reliability

If session information and encryption keys are stored and maintained at the gateway for each communication session, then end-to-end encryption is achieved, but computing resources such as processing power and storage space are consumed

Engineering Contradiction:

Improveend-to-end encryptionVSAvoidcomputing resources including storage space

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

Encryption keys are extracted from persistent storage and loaded into memory only when needed for active communication sessions. The gateway generates encryption keys temporarily for each session rather than maintaining them permanently, reducing storage space requirements while preserving encryption capabilities

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The gateway dynamically manages the lifetime and validity period of session information and encryption keys. By implementing time-based expiration and active/inactive state transitions, the system maintains encryption security for active sessions while automatically releasing resources for inactive sessions, optimizing the balance between security and resource consumption

Inventive Principle:

Principle #35Parameter changes

3Reliability

If communication sessions are initiated and established with multiple requests and responses among customer device, partner server, gateway, and resource service, then controlled access is achieved, but complexity in initiating and establishing sessions increases

Engineering Contradiction:

Improvecontrolled accessVSAvoidcomplexity in initiating and establishing sessions

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent combines authentication, session establishment, and resource access authorization into a single integrated session information structure. Instead of separate processes for authentication and session management, the gateway generates comprehensive session information that encompasses both authentication results and access permissions, reducing the number of separate communication steps required

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The gateway acts as a central intermediary that consolidates session management functions. Rather than having multiple entities (customer device, partner server, resource service) independently manage session state, the gateway serves as the single source of truth for session information, simplifying the overall system complexity while maintaining controlled access

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20250023732A1End-to-end encryption for sessionless communications

Publication Date: 2025.01.16 CITICORP CREDIT SERVICES INC (USA)

AI summary

Presented herein are systems and methods for end-to-end encryption for session-less communications. A first server may receive, from a second server, a request to retrieve keys for a customer device to access a service. The request may include a device identifier and a first token encrypted using a first encryption key. The first server may determine, responsive to validating, that the customer device is to be issued a second token. The first server may identify least a portion of the first token decrypted using the first encryption key. The first server may generate a set of second encryption keys to be used by the customer device. The first server may package the second token to include (i) at least the portion of the first token and (ii) the set of second encryption keys. The first server may transmit, to the second server, a response including the second token.