Single-Use Authorization Codes with Self-Contained Cryptographic Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face inefficiencies in generating and validating access tokens, often requiring database queries for authorization code validation, which can be resource-intensive and vulnerable to misuse due to potential storage of authorization codes.
Innovation Solution
The generation of single-use authorization codes in a self-contained format using unique key pairs, where the private key is used for signing and the public key for verification, with both keys being stored in-memory and dynamically deleted after use, eliminating the need for database queries and ensuring single-use validation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authorization codes are stored in database for validation, then authorization validation can be performed, but resource consumption increases and security vulnerability increases
Solution Approach 1:
The patent extracts the authorization code validation logic from database-dependent operations to self-contained JWT tokens. Each authorization code is encoded as a JWT containing all necessary validation information, eliminating the need to query databases during validation. This extraction reduces resource consumption by removing database I/O operations while maintaining reliable authorization validation through cryptographic verification of the JWT signature.
2Reliability
If authorization codes are stored in database, then validation can be performed, but security vulnerability increases due to potential storage and reuse
Solution Approach 1:
The patent implements authorization codes as single-use JWT tokens that are discarded after one validation. Each authorization code is generated as a self-contained JWT with a unique signature, validated once, and then rendered useless. This disposable approach eliminates security vulnerabilities associated with storing and reusing authorization codes in databases, as each code exists only momentarily in memory and cannot be reused or compromised through database breaches.
Solution Approach 2:
The patent introduces JWT cryptographic signatures as an intermediary mechanism between authorization code generation and validation. Instead of directly storing and querying authorization codes from databases, the system uses JWT signatures to mediate the validation process. The signature serves as a trust intermediary that proves the authorization code's authenticity without requiring the actual code to be stored or retrieved from persistent storage, thereby reducing security vulnerabilities.
3Reliability
If database queries are used for authorization code validation, then validation can be performed, but processing speed decreases
Solution Approach 1:
The patent performs preliminary action by encoding all necessary validation information into the JWT authorization code during generation. The authorization code is pre-signed with a unique signature and contains all required claims for validation. This preliminary encoding eliminates the need for subsequent database queries during validation, as all verification data is already embedded in the token itself, significantly improving processing speed while maintaining reliable validation through cryptographic verification.
Data Source
AI summary
The present disclosure relates to computer-implemented methods, software, and systems for generating access tokens at an authentication server based on authorization codes. A first authorization server from a set of authorization servers receives a request for authorization of a request to access a resource by a resource owner. The first authorization server validates the request for authorization of the request to generate an authorization code. In response to successful validation of the request for authorization to generate the authorization code, the first authorization server generates a single-use authorization code by signing the generated authorization code with a unique private key. A unique public key is maintained for verifying the signed authorization code. The single-use authorization code is generated in a self-contained format. The single-use authorization code is provided to the client application for generation of an access token by one of the authorization servers from the set of authorization servers.