DAT (Data Authentication Token) ​

1. Overview (Introduction) ​

As the number of concurrent users increases, the number of sessions grows accordingly, placing excessive load on the session server.

DAT is a token specification designed to resolve this session server load problem and to implement efficient, Stateless authentication that does not share state between servers.

2. Token Structure (Structure) ​

2.1. Field Specifications ​

Expiration Time : uint64 (Unix Time)

• Represents the token's expiration time as a 64-bit unsigned integer in seconds (Unix Time).

CID : Hex (uint64)

• The Certificate ID used to validate the token.

Plain Data : Base64Url (Binary)

• Contains data to be exposed to the client. Supports not only strings but also binary data, which the client can decode and inspect.

Secure Data : Base64Url (Binary)

• Contains data to be kept private from the client. It is encrypted using a certificate-based encryption algorithm, so the client cannot decrypt the contents.

Signature : Base64Url (Binary)

• Signature data used to verify the integrity and authenticity of the token. Generated by signing the preceding fields using the certificate's signing algorithm.

3. Comparison with JWT ​

DAT and JWT (JSON Web Token) share a dot (.) delimited token structure and a signature-based verification approach, but differ in the following key ways in their internal design.

3.1. Structural Comparison ​

• JWT Structure

  header	body	signature
  Base64Url (JSON String)	Base64Url (JSON String)	Base64Url (Binary)

• DAT Structure

  Expiration Time	CID	Plain Data	Secure Data	Signature
  Unixtime (uint64)	Hex (uint64)	Base64Url (Binary)	Base64Url (Encrypt Binary)	Base64Url (Binary)

3.2. Key Differences ​

• Binary-based Lightweight Design: JWT handles Header and Body as JSON strings, whereas DAT works directly with Binary data, optimizing data size and improving parsing efficiency.
• Built-in Security (Secure Data (secure) field): JWT exposes the Payload in plaintext by default, requiring a separate spec such as JWE when encryption is needed. In contrast, DAT supports encryption natively through the Secure Data field.
• Enforced Expiration Time: In JWT, the exp (Claims) field is optional, but in DAT the Expiration Time (expire) field is structurally mandatory, making expiration validation a required step.