# US 12,113,903 B2 · Long-lasting refresh tokens in self-contained format > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,903 B2 - Document ID: US12113903B2 - Status: Granted - Kind: B2 - Application number: 18/148,935 - Filed: 2022-12-30 - Published: 2023-05-04 - Granted: 2024-10-08 - Earliest claimed: 2021-01-26 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Radoslav Ivanov Sugarev - Web page: https://patentgrep.com/patent/US12113903B2 ## CPC - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 9/3247: {involving digital signatures} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present disclosure relates to computer-implemented methods, software, and systems for securely generating a new access token based on relatively long-lasting refresh tokens in self-contained format. A first request to generate a new access token for authorization of a client application with an application server is received and includes a first protected version of a refresh token. The first protected version of the refresh token is an encrypted version of the refresh token based on a first client identifier. The first protected version of the refresh token is decrypted to determine content of the refresh token based on a second client identifier of the client application that is externally invoked for validating the authorization. In response to successfully decrypting the first protected version, performing a validation of the refresh token. In response to successfully validating the refresh token, generating the new access token and providing it to the client application. ## Claims ### Claim 1 A computer-implemented method, the method comprising: regenerating and storing, by a client application, a new protected version of a refresh token based on a new version of a client key, wherein the new protected version of the refresh token is an encrypted version of the refresh token based on the new version of the client key, wherein the new version of the client key replaces a previous version of the client key persisted at a key store for the client application, wherein a single version of the client key is maintained at any point in time at the key store; sending, by the client application and to an authorization server, a request to generate a new access token for authorization of the client application with an application server, wherein the request includes the new protected version of the refresh token to authenticate with the authorization server for generating the new access token for authorization of accessing resources at the application server; and receiving, by the client application and from the authorization server, the new access token, wherein the new access token is successfully validated at the authorization server based on decrypting the new access token using the new version of the client key. ### Claim 2 (depends on 1) The method of claim 1, comprising: sending a request to generate the new version of the client key for the client application; providing access to the key store for the application server and the authorization server to perform validation of requests requiring encryption with the client key. ### Claim 3 (depends on 1) The method of claim 1, wherein the refresh token is a self-contained token that is readable by the authorization server. ### Claim 4 (depends on 1) The method of claim 1, comprising: obtaining, from a key management tool and at the authorization server, the new version of the client key as a current client identifier for decrypting protected refresh tokens in response to receiving requests for generation of access tokens. ### Claim 5 (depends on 1) The method of claim 1, comprising: at the authorization server, decrypting the new protected version of the refresh token to determine content of the refresh token, wherein the decrypting of the new protected version is based on a decryption client key of the client application that is externally invoked for validating the authorization; in response to successfully decrypting the new protected version of the refresh token, performing the validating of the refresh token to determine whether to authorize a generation of the new access token for the client application. ### Claim 6 (depends on 4) The method of claim 4, wherein successfully decrypting the new protected version of the refresh token to determine the content of the refresh token comprises: decrypting the new protected version of the refresh token based on the decryption client key of the client application; and in response to successfully decrypting the new protected version of the refresh token with the decryption client key, validating the refresh token as a valid token for requesting the new access token. ### Claim 7 (depends on 4) The method of claim 4, wherein the new version of the client key and the decryption client key are symmetric keys generated for secure protection of exchange of information associated with the client application. ### Claim 8 (depends on 1) The method of claim 1, wherein the new protected version of the refresh token is decrypted based on the new version of the client key when obtained at the authorization server. ### Claim 9 (depends on 1) The method of claim 1, wherein sending the request to generate the new access token comprises: generating a signature for the refresh token based on the new version of the client key; and sending the new protected version of the refresh token together with the signature to the authorization server for performing validation at the authorization server. ### Claim 10 (depends on 9) The method of claim 9, comprising: at the authorization server: decrypting the new protected version of the refresh token by validating the signature of the new protected version of the refresh token, wherein the signature is validated based on a decryption client key associated with the client application. ### Claim 11 (depends on 1) The method of claim 1, wherein the refresh token is a string representing an authorization granted and is associated with a first validity period, wherein the new access token is associated with a second validity period, and wherein the first validity period is longer than the second validity period. ### Claim 12 (depends on 1) The method of claim 1, comprising: sending, by the client application, a request to the application server to access a first resource, wherein the request includes an old access token generated by the authorization server for the client application prior the generation of the new access token; and receiving a denial for accessing the first resource at the application server based on failure to validate the old access token. ### Claim 13 A non-transitory, computer-readable medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations, the operations comprising: regenerating and storing, by a client application, a new protected version of a refresh token based on a new version of a client key, wherein the new protected version of the refresh token is an encrypted version of the refresh token based on the new version of the client key, wherein the new version of the client key replaces a previous version of the client key persisted at a key store for the client application, wherein a single version of the client key is maintained at any point in time at the key store; sending, by the client application and to an authorization server, a request to generate a new access token for authorization of the client application with an application server, wherein the request includes the new protected version of the refresh token to authenticate with the authorization server for generating the new access token for authorization of accessing resources at the application server; and receiving, by the client application and from the authorization server, the new access token, wherein the new access token is successfully validated at the authorization server based on decrypting the new access token using the new version of the client key. ### Claim 14 (depends on 13) The computer-readable medium of claim 13, comprising instructions which when executed by the one or more processors, cause the one or more processors to perform operations comprising: sending a request to generate the new version of the client key for the client application; providing access to the key store for the application server and the authorization server to perform validation of requests requiring encryption with the client key. ### Claim 15 (depends on 13) The computer-readable medium of claim 13, wherein the refresh token is a self-contained token that is readable by the authorization server. ### Claim 16 (depends on 13) The computer-readable medium of claim 13, comprising instructions which when executed by the one or more processors, cause the one or more processors to perform operations comprising: obtaining, from a key management tool and at the authorization server, the new version of the client key as a current client identifier for decrypting protected refresh tokens in response to receiving requests for generation of access tokens. ### Claim 17 A system comprising a computing device; and a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations, the operations comprising: regenerating and storing, by a client application, a new protected version of a refresh token based on a new version of a client key, wherein the new protected version of the refresh token is an encrypted version of the refresh token based on the new version of the client key, wherein the new version of the client key replaces a previous version of the client key persisted at a key store for the client application, wherein a single version of the client key is maintained at any point in time at the key store; sending, by the client application and to an authorization server, a request to generate a new access token for authorization of the client application with an application server, wherein the request includes the new protected version of the refresh token to authenticate with the authorization server for generating the new access token for authorization of accessing resources at the application server; and receiving, by the client application and from the authorization server, the new access token, wherein the new access token is successfully validated at the authorization server based on decrypting the new access token using the new version of the client key. ### Claim 18 (depends on 17) The system of claim 17, wherein the computer-readable storage device has instructions which when executed by the computing device, cause the computing device to perform operations comprising: sending a request to generate the new version of the client key for the client application; providing access to the key store for the application server and the authorization server to perform validation of requests requiring encryption with the client key. ### Claim 19 (depends on 17) The system of claim 17, wherein the refresh token is a self-contained token that is readable by the authorization server. ### Claim 20 (depends on 17) The system of claim 17, wherein the computer-readable storage device has instructions which when executed by the computing device, cause the computing device to perform operations comprising: obtaining, from a key management tool and at the authorization server, the new version of the client key as a current client identifier for decrypting protected refresh tokens in response to receiving requests for generation of access tokens.