Client-server security enhancement using information accessed from access tokens

US11190514B2 · kind B2 · utility

Assignee

• MICROSOFT TECHNOLOGY LICENSING, LLC · US

Inventors

• Anshul Dube · Redmond, US
• Xiaoqin Zhu · Redmond, US
• Andrew Burke Ryan · Seattle, US
• Shankaranand Arunachalam · Redmond, US
• Gokay Hurmali · Redmond, US
• Dmitri Gavrilov · Redmond, US
• Ganesh Pandey · Redmond, US
• Parul Manek · Redmond, US

Key dates

• Filing date: Jun 17, 2019
• Grant date: Nov 30, 2021
• Expiry date: Nov 13, 2039

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L63/0807
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

A service computing system receives an API call in which an authorization token, that contains an identifier in the content of the authorization token, is included in a header of the API call. The identifier is also included as a parameter passed in with the API call. The service computing system parses the API call to obtain the authorization token, and the identifier included in the authorization token. It also obtains the identifier passed in as a parameter of the API call. The service computing system compares the identifier obtained from the authorization token to the identifier passed in as a parameter of the API call to determine whether they match. If they do not match, the API call is processed as an unauthorized API call. A security system in the service computing system authorizes the API call based on the comparison.