Patent ID: 9237020
Filing Date: 2016-01-12
CPC Classification: H04L

Claim Text:
1. A method for controlling exposure of sensitive data using process-bound security tokens comprising: receiving by an owning process a set of user authentication credentials to create a request message request to access or communicate to a targeted server; creating and signing with a first token issuer cryptographic key a first security token that is owned by the owning process; sending by the owning process to a downstream server the first security token and the request message; endorsing the request message by the downstream server by attaching a second security token representing the downstream server, wherein the second security token is signed by a second token issuer cryptographic key; sending by the downstream server the endorsed request message to the targeted server; responsive to one or more security verifications of the endorsed request message, issuing by the targeted server a user token; returning the user token to the owning process; the owning process storing and associating the user token with a single sign-on token; sending by the owning process the associated single sign-on token to a requester identified by the user authentication credentials; subsequent to the sending of the single sign-on cookie, receiving a second request message by the owning process for access to or communication with the target server, wherein the second request has the single sign-on attached; retrieving by the owning process the stored user token; forwarding by the owning process the second request message with the retrieved user token to the downstream server; endorsing by the downstream server the second request message by attaching the second security token; sending by the downstream server the endorsed second request to the targeted server, responsive to one or more security verifications of the endorsed second request, performing by the targeted server a requested access, usage of a resource, or performance of a service according to the second request; responsive to generation of results from the access, usage, or service performance, returning the results to the owning process with the user token attached; detaching by the owning process the user token from the results; and forwarding by the owning process to the requester the results with the single sign-on cookie.