# US 11,451,537 B2 · Securing identity token forwarding > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,537 B2 - Document ID: US11451537B2 - Status: Granted - Kind: B2 - Application number: 16/848,961 - Filed: 2020-04-15 - Published: 2021-10-21 - Granted: 2022-09-20 - Earliest claimed: 2020-04-15 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Peter Eberlein - Web page: https://patentgrep.com/patent/US11451537B2 ## CPC - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and computer-readable storage media for receiving, from a first component and by a second component in a cloud platform, a call, a token, and a first client certificate, determining, by the second component, a first client identifier associated with the first component, and determining, by the second component, that the first client identifier is included in a manifest of the token, the manifest defining at least a portion of a communication path between components within the cloud platform, and in response: executing functionality responsive to the call. ## Claims ### Claim 1 A computer-implemented method for secure access token forwarding between components in cloud platforms, the method being executed by one or more processors and comprising: receiving, from a first component and by a second component in a cloud platform, a first call, a token, and a first client certificate; wherein the token provided to the first component in response to a request from the first component to a central identity and authentication service (IAS) of the cloud platform, and the first client certificate is provided during execution of a process to generate the token; determining, by the second component, a first client identifier associated with the first component; determining, by the second component, that the first client identifier is included in a manifest of the token, the manifest defining at least a portion of a communication path between components within the cloud platform, and in response: executing functionality responsive to the first call; receiving, from a third component and by the second component, a second call, the token, and a second client certificate; determining, by the second component, a second client identifier associated with the third component; and determining, by the second component, that the second client identifier is absent from the manifest of the token, and in response: transmitting an error to the third component. ### Claim 2 (depends on 1) The method of claim 1, wherein executing functionality responsive to the first call at least partially comprises transmitting, from the second component and to a third component, a second call with the token. ### Claim 3 (depends on 1) The method of claim 1, wherein the token is received by the first component from a third component. ### Claim 4 (depends on 1) The method of claim 1, wherein the token comprises an open authentication (OAuth) client comprising an audience field populated with the manifest, and the first client certificate comprises a X.509 client certificate. ### Claim 5 A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for secure access token forwarding between components in cloud platforms, the operations comprising: receiving, from a first component and by a second component in a cloud platform, a first call, a token, and a first client certificate; wherein the token provided to the first component in response to a request from the first component to a central identity and authentication service (IAS) of the cloud platform, and the first client certificate is provided during execution of a process to generate the token; determining, by the second component, a first client identifier associated with the first component; determining, by the second component, that the first client identifier is included in a manifest of the token, the manifest defining at least a portion of a communication path between components within the cloud platform, and in response: executing functionality responsive to the first call; receiving, from a third component and by the second component, a second call, the token, and a second client certificate; determining, by the second component, a second client identifier associated with the third component; and determining, by the second component, that the second client identifier is absent from the manifest of the token, and in response: transmitting an error to the third component. ### Claim 6 (depends on 5) The computer-readable storage medium of claim 5, wherein executing functionality responsive to the first call at least partially comprises transmitting, from the second component and to a third component, a second call with the token. ### Claim 7 (depends on 5) The computer-readable storage medium of claim 5, wherein the token is received by the first component from a third component. ### Claim 8 (depends on 5) The computer-readable storage medium of claim 5, wherein the token comprises an open authentication (OAuth) client comprising an audience field populated with the manifest, and the first client certificate comprises a X.509 client certificate. ### Claim 9 A system, comprising: a computing device; and a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for natural language explanations for secure access token forwarding between components in cloud platforms, the operations comprising: receiving, from a first component and by a second component in a cloud platform, a first call, a token, and a first client certificate; wherein the token provided to the first component in response to a request from the first component to a central identity and authentication service (IAS) of the cloud platform, and the first client certificate is provided during execution of a process to generate the token; determining, by the second component, a first client identifier associated with the first component; determining, by the second component, that the first client identifier is included in a manifest of the token, the manifest defining at least a portion of a communication path between components within the cloud platform, and in response: executing functionality responsive to the first call; receiving, from a third component and by the second component, a second call, the token, and a second client certificate; determining, by the second component, a second client identifier associated with the third component; and determining, by the second component, that the second client identifier is absent from the manifest of the token, and in response: transmitting an error to the third component. ### Claim 10 (depends on 9) The system of claim 9, wherein executing functionality responsive to the first call at least partially comprises transmitting, from the second component and to a third component, a second call with the token. ### Claim 11 (depends on 9) The system of claim 9, wherein the token is received by the first component from a third component.