Signed Protobuf Web Tokens for Spoofing-Resistant Microservices

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The challenge of scaling cybersecurity threat detection and mitigation systems to effectively respond to an increasing volume of threats in cloud-based environments without technical inefficiencies, particularly in managing authentication and authorization within microservice components.

Innovation Solution

The use of digitally signed Protobuf web tokens to securely share sensitive data among microservice components, involving authentication and authorization services to generate, adapt, and transmit API requests, ensuring valid authentication and permissions are verified without additional service interactions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional authentication and authorization methods are used in microservice components, then security can be maintained, but system complexity and processing time increase significantly when scaling to handle large volumes of threats

Engineering Contradiction:

ImprovesecurityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system performs authentication and authorization actions in advance by issuing tokens that contain pre-validated authentication data and permission sets. When API requests arrive, the microservice components can validate tokens locally without needing to interact with authentication services, thus maintaining security while reducing real-time processing complexity.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Tokens act as intermediaries that carry authentication and authorization information between the API gateway and microservice components. Instead of direct communication between multiple services for authentication verification, the token serves as a self-contained mediator that enables local validation, reducing system complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If additional service interactions are implemented for authentication verification, then security can be enhanced, but processing speed and response time deteriorate

Engineering Contradiction:

ImprovesecurityVSAvoidprocessing speed

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

Authentication and authorization are performed in advance when tokens are issued. The tokens contain all necessary validation information, allowing microservice components to verify authenticity locally without additional service interactions during request processing, thus maintaining security while improving processing speed.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If manual authentication and authorization management is used, then security control can be precise, but productivity and response efficiency decrease when handling large volumes of threats

Engineering Contradiction:

Improvesecurity controlVSAvoidthreat response efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system enables self-service authentication and authorization through self-contained tokens that microservice components can validate independently. Each token carries its own authentication data and permission sets, allowing components to autonomously verify requests without manual intervention or additional service interactions, thus maintaining precise security control while dramatically improving productivity.

Inventive Principle:

Principle #25Self-service

4Reliability

If tokens contain comprehensive authentication and permission data, then security and access control improve, but token size and data transmission overhead increase

Engineering Contradiction:

Improveaccess controlVSAvoidtoken size

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The system extracts only the essential authentication and authorization information needed for validation into the token, separating it from unnecessary data. This allows tokens to contain comprehensive access control information while minimizing size by including only what is necessary for local validation by microservice components.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS20260039473A1Systems and methods for intelligently constructing, transmitting, and validating spoofing-conscious digitally signed web tokens using microservice components of a cybersecurity threat mitigation platform

Publication Date: 2026.02.05 EXPEL INC

AI summary

A system and method for using digitally signed web tokens to securely share sensitive data includes identifying an API request that includes an authorization header comprising authentication data; assessing the authentication data of the API request against a corpus of valid authentication data; identifying the authentication data as valid authentication data and a target entity that corresponds to the authentication data; obtaining a set of permissions associated with the target entity; generating a digitally signed protobuf web token that includes a representation of the target entity and a representation of the set of permissions associated with the target entity; and based on the generation of the digitally signed protobuf web token: adapting the API request to an adapted API request that includes a header component comprising the digitally signed protobuf web token; and transmitting the adapted API request to a target API-processing service.