Patent ID: 9531538
Filing Date: 2016-12-27
CPC Classification: H04L

Claim Text:
1. A method for controlling exposure of sensitive data using process-bound security tokens comprising: receiving by an owning process from a requester a set of user authentication credentials to create a request message to access or communicate to a targeted server, wherein the owning process and the requester are separate computing entities; creating and signing with a first token issuer cryptographic key a first security token that is owned by the owning process; sending by the owning process to a downstream server the first security token and the request message; endorsing the request message by the downstream server by attaching a second security token representing the downstream server, wherein the second security token is signed by a second token issuer cryptographic key; sending by the downstream server the endorsed request message to the targeted server; responsive to one or more security verifications of the endorsed request message, issuing by the targeted server a user token; returning the user token to the owning process; storing and associating by the owning process the user token with a single sign-on token, wherein the single sign-on token is separate from the user token; sending by the owning process the associated single sign-on token to the requester identified by the user authentication credentials; thereby preventing exposure of the user token to the requester.