Integrated Token Provisioning in Secure Authentication Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing transaction systems require multiple steps and resources to authenticate users and provision tokens, leading to significant burden on computing resources, especially during high-volume transactions.
Innovation Solution
A method that integrates token provisioning within a secure authentication system by transmitting an authentication request message including a token request indicator, allowing the access control server to authenticate users and generate a verification value, which is then used to obtain a token from a token provider, reducing the need for separate messages and enhancing efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate authentication and token provisioning processes are used, then security and reliability are improved, but device complexity and processing time increase
Solution Approach 1:
The patent combines authentication and token provisioning into a single integrated process. The authentication request message simultaneously carries both authentication credentials and token provisioning requests, allowing both operations to be completed in one transaction rather than requiring separate messages and processing steps.
Solution Approach 2:
The authentication message structure is designed to serve multiple functions: it authenticates the user, provisions tokens, and communicates user-specific data all through a single message exchange. This multi-functional approach reduces the number of interfaces and messages needed in the system.
2Reliability
If multiple messages are exchanged for authentication and token provisioning, then reliability is improved, but loss of time and productivity decrease
Solution Approach 1:
Multiple operations (authentication, token provisioning, data communication) are merged into a single message exchange sequence. The authentication request message contains both the authentication credentials and the token provisioning request, eliminating the need for separate message exchanges.
Solution Approach 2:
The token provisioning is initiated within the authentication request itself, before the authentication process completes. This preliminary action allows the token to be ready by the time authentication finishes, eliminating waiting time that would occur if token provisioning happened sequentially after authentication.
3Adaptability or versatility
If additional interfaces are added for user-specific data communication, then adaptability is improved, but device complexity increases
Solution Approach 1:
The existing authentication message structure is enhanced to serve multiple purposes: authentication, token provisioning, and user-specific data communication. This universal message format eliminates the need for separate dedicated interfaces for each function.
Solution Approach 2:
User-specific data is segmented into the authentication response message as a distinct component. This allows the data to be communicated efficiently within the existing message flow without requiring a separate interface, while maintaining the ability to handle different types of user data through structured fields.
Data Source
AI summary
Systems and methods of the invention are directed to provisioning a token by a secure authentication system. A user may initiate a transaction that causes a resource provider computer to transmit an authentication request message to a directory server computer. The directory server computer may transmit the authentication request message to an access control server computer for authentication. Subsequent to receiving the authentication request message, the directory server computer may request a token for the transaction from a token provider computer. If authentication is successful, the token may be included in an authentication response message transmitted by the directory server computer to the resource provider computer. The token may then be utilized by the resource provider computer in lieu of sensitive user information for any suitable purpose. In some embodiments, user-specific-data provided by the access control server computer may be included in the authentication response message.