Two-Sided Token Mechanism for Bidirectional OAuth Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current OAuth implementations only facilitate one-directional information sharing between services, requiring users to log in and authorize separately for reciprocal access, leading to an inefficient token exchange process.
Innovation Solution
A two-sided token mechanism is introduced, where both parties issue tokens during a single user journey, eliminating the need for separate authorization processes and enabling bi-directional OAuth exchanges without requiring users to log in multiple times.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single access token is exchanged in OAuth, then the authorization process is simple and straightforward, but information sharing is limited to one direction only
Solution Approach 1:
The patent merges two separate OAuth flows into a single unified authorization process. Instead of requiring separate authorization requests for each direction, the system combines both authorization requests and responses into one coordinated flow, where Party A and Party B simultaneously exchange tokens in both directions through a single user approval action.
Solution Approach 2:
The patent inverts the traditional sequential OAuth approach by implementing simultaneous bidirectional authorization. Rather than Party A authorizing Party B first, then Party B authorizing Party A separately, the system enables both parties to authorize each other concurrently in a single authorization event, reversing the conventional one-way sequential model.
2Adaptability or versatility
If separate authorization flows are implemented for each direction, then bi-directional access is achieved, but the user experience deteriorates due to multiple login requirements
Solution Approach 1:
The patent combines multiple separate authorization actions into a single user approval event. Instead of requiring the user to log in and authorize separately for each direction, the system merges both authorization requests into one coordinated flow where a single user action grants both parties access simultaneously.
Solution Approach 2:
The system performs preliminary coordination between Party A and Party B to prepare both authorization requests before presenting them to the user. This preliminary action ensures that when the user approves, both authorization flows are already configured and ready to execute simultaneously, eliminating the need for multiple separate login events.
3Ease of manufacture
If traditional OAuth is used, then the implementation is straightforward, but additional authorization flows are required for reciprocal access
Solution Approach 1:
The patent creates a universal authorization framework that handles both unidirectional and bidirectional authorization scenarios through a single standardized flow. The system design allows the same authorization mechanism to serve multiple purposes - whether Party A needs access to Party B's resources, Party B needs access to Party A's resources, or both parties need mutual access - all through the same unified process.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for implementing a two-side token for OAUTH are described. A first request for access by a partner app server to user account information owned by a host server is received at a host auth server. Upon receiving authorization to share the user account information, a response is returned to the partner app sever. The response includes an access token. In response to returning the response to the partner app server, an event is written to an event queue. The event provides an indication that the request for access was received and that the corresponding response with the access token was returned. The event, when read by a host app server, instructs the host app server to submit a second request to a partner auth server for a reciprocal access token.