Secure Token Exchange via Reference Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing token exchange implementations either embed prior tokens within new tokens, increasing their size and risking truncation, or expose unauthorized parties to prior token contents, and may prevent revalidation of identity tokens if only partial attributes are included.
Innovation Solution
A computer-implemented method for optimizing security token exchange by receiving a request from a client, extracting and validating a second security token, retrieving a first security token based on an API call, embedding the second token in the API, and sending a request with a third security token and API reference to another domain, while denying the request if the second token is not valid.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a prior token is embedded inside a newly issued token, then the new token maintains a reference to the prior token, but the new token size increases significantly which may make the token useless due to browser limitations
Solution Approach 1:
The patent extracts the prior token reference mechanism from direct embedding and places it in a separate, accessible location (such as a database or cache). The new token contains only a reference identifier to the prior token, not the full token content. This allows the new token to remain small while still maintaining reliable reference to the prior token for validation purposes.
2Reliability
If a prior token is embedded inside a newly issued token, then the new token maintains a reference to the prior token, but the new token voluntarily exposes prior token contents to parties that are not authorized to see the token
Solution Approach 1:
The patent extracts the prior token content from the new token structure. Instead of embedding the full prior token, the system stores only a reference identifier in the new token and retrieves the actual token content from a secure storage location only when needed and authorized. This prevents unauthorized parties from accessing prior token contents while maintaining reliable references for validation.
Solution Approach 2:
The patent introduces an intermediary component (such as a token validation service or database) that mediates between the new token and the prior token. This intermediary handles the retrieval and validation of prior tokens only when necessary, preventing direct exposure of token contents to unauthorized parties while maintaining the reference relationship.
3Length of moving object
If only a portion of a prior token is included in the new token, then the new token size is reduced, but it prevents an upstream service from revalidating a prior identity token if full access is necessary
Solution Approach 1:
The patent extracts the full prior token from embedding and stores it separately in a secure location. The new token contains only a reference identifier. When revalidation is needed, the system retrieves the full prior token from storage using the reference identifier. This approach keeps the new token small while ensuring full access to the prior token is available when required for revalidation.
Solution Approach 2:
The patent performs preliminary action by storing the full prior token in a secure location before the new token is issued. This pre-stored reference allows the system to quickly retrieve and validate the prior token when needed, without requiring the prior token to be embedded in the new token. This resolves the contradiction by preparing the full token availability in advance while keeping the new token compact.
Data Source
AI summary
An approach for optimizing security token exchange. The approach receives a first request from a client. The approach extracts a first security token and an API reference. The approach validates the first security token. If the security token is valid, then the approach, calls the API and retrieves a second security token, embeds the second security token in the API and sends a second request with a third security token and the reference to the API to another application in a different domain.