Transaction Coordination Authentication via Digital Tokens

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Application servers that support distributed transactions, such as WebLogic Server, are unable to securely process transaction coordination calls over insecure connections, making them vulnerable to man-in-the-middle attacks, and existing solutions like SSL/TLS mutual authentication are not always viable.

Innovation Solution

The use of coordinator and sub-coordinator tokens for authenticating transaction coordination messages, where the coordinator generates a unique token sent to the sub-coordinator, and vice versa, allowing for secure authentication over insecure connections through digital signatures and encryption, with the option to regenerate tokens in case of server crashes and specify authentication algorithms.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If SSL/TLS mutual authentication is used to secure transaction coordination connections, then security against man-in-the-middle attacks is improved, but device complexity and administrative setup increase

Engineering Contradiction:

ImprovesecurityVSAvoidadministrative setup

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the authentication mechanism from the transport layer (SSL/TLS) and implements it at the application layer using digital signatures and tokens. This removes the dependency on complex SSL/TLS mutual authentication while maintaining security, as the digital signature verification provides authentication without requiring certificate management infrastructure

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces digital tokens as intermediaries that carry authentication information between coordinator and sub-coordinator. These tokens, signed with private keys and verified with public keys, serve as a lightweight alternative to SSL/TLS certificates, providing the same authentication function with reduced complexity

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If SSL/TLS mutual authentication is implemented, then security is improved, but performance deteriorates due to encryption overhead

Engineering Contradiction:

ImprovesecurityVSAvoidperformance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent removes the heavy cryptographic overhead of SSL/TLS encryption from the transaction coordination protocol and replaces it with lightweight digital signature verification. Digital signatures provide authentication without requiring the symmetric encryption and handshake protocols that burden SSL/TLS performance

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent uses disposable digital tokens that are generated, used for authentication, and then discarded. These tokens are much cheaper computationally than maintaining SSL/TLS sessions, as they require only signature verification rather than continuous encrypted communication channels

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Ease of operation

If transaction coordination messages are sent over insecure connections, then ease of operation is improved, but security deteriorates due to vulnerability to man-in-the-middle attacks

Engineering Contradiction:

Improveconnection setupVSAvoidsecurity

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent performs preliminary authentication by attaching digital signatures to transaction coordination messages before transmission. This preliminary signing action ensures that even though the connection is insecure, the messages cannot be tampered with or forged, as the digital signature provides cryptographic proof of authenticity

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses digital tokens as intermediaries that mediate trust between coordinator and sub-coordinator over insecure connections. The tokens, containing authenticated information signed with private keys, allow the parties to verify each other's identity without requiring a secure transport layer

Inventive Principle:

Principle #24Intermediary (Mediator)

Applied Scientific Principles

This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.

Function Achieved in This Case

This solution provides secure authentication of transaction coordination messages over insecure connections, minimizing administrative setup and performance impact, while protecting against man-in-the-middle attacks and ensuring transaction integrity.

Implementation Method 1

The coordinator and sub-coordinator tokens are used to authenticate transaction coordination messages sent over one or more insecure connections between the coordinator and the sub-coordinator

Methodology Applied

Scientific EffectDigital signature authentication:

Data Source

PatentUS7975138B2Systems and methods for mutually authenticated transaction coordination messages over insecure connections

Publication Date: 2011.07.05 ORACLE INT CORP

AI summary

Systems and methods are provided that enable authentication of transaction coordination messages sent via insecure connections. Also provided are systems and methods for controlling transaction coordination and recovery. In many embodiments, there is an exchange between a coordinator and a sub-coordinator, such that the coordinator provides the sub-coordinator with a coordinator token, and the sub-coordinator provides the coordinator with a sub-coordinator token. The coordinator and sub-coordinator tokens are used to authenticate transaction coordination messages sent over one or more insecure connections between the coordinator and the sub-coordinator.