Token based security protocol for managing access to web services

An application server, comprising:

• a network communication device configured to exchange data communications through a communication network, the communication network including at least one database accessible to the network communication device;
• a processor coupled to the network communication device;
• a storage device accessible to the processor;
• and
• an application program in the storage device, the application program including a plurality of functions of a web service, wherein execution of the application program by the processor configures the application server to exchange data communications related to the plurality of functions of the web service with an associated client of a user device through the communication network,
• wherein the processor is configured to perform functions including:
• a message handling function to receive through a communication network from a client executing at a user device, a request message requesting access to one of the functions of the web service, the request message including a function identifier identifying the one function of the web service and further including a security token associated with the client;
• a token validation function to validate the security token based on token validation information included within the security token and the function identifier, the security token being associated with one or more functions of the functions of the web service;
• a client information extraction function to extract authentication information for the client from the security token;
• a client authentication function to authenticate the client based on the authentication information extracted from the security token;
• a request processing function to process the request message from the client so as to make the one function of the web service as identified by the function identifier in the request message accessible to the client through the communication network, when the security token is validated via the token validation function and when the client is authenticated via the client authentication function;
• and
• a response communication function to transmit a response message through the communication network to the client at the user device based on the processing of the request message.

An article of manufacture, comprising a non-transitory computer-readable medium and computer-executable instructions embodied in the medium that, if executed by a computing device, cause the computing device to perform functions including functions to:

• receive through a communication network from a client executing at a user device, a request message requesting access to a particular function from among a plurality of functions offered by a web service hosted at the computing device, the request message including a function identifier identifying the particular function and further including a security token associated with the client;
• validate the security token based on token validation information included within the security token and the function identifier, the security token being associated with one or more functions from the plurality of functions offered by the web service;
• extract authentication information for the client from the security token;
• authenticate the client based on the authentication information extracted from the security token for the client;
• process the request message from the client so as to make the particular function as identified by the function identifier in the request message accessible to the client through the communication network, when the token is validated based on the token validation information and the function identifier and when the client is authenticated based on the authentication information;
• and
• transmit a response message through the communication network from the server to the client at the user device based on the processing of the request message and the validation of the security token and the authentication of the client.