Multi-factor authentication and authorization for API calls

Abstract

A method for authenticating and authorizing a user identifier for accessing a service is disclosed. The service is invoked by an application programming interface of the service, which requests two-factor authorization to initiate execution of the service for the requesting user identifier. The method includes receiving a service request by the service's API along with first and second data for first and second authentication methods, verifying the validity of the first data as a first ID passkey using the first authentication method, verifying the validity of the second data as a second ID passkey using the second authentication method, the first ID passkey being an input to the second authentication method, the second authentication method being different from the first authentication method, and executing the service upon receiving that the validity of both the first ID passkey and the second ID passkey have been verified.

Description

[Technical field]

[0001] The present invention relates generally to methods for authenticating and authorizing, and more particularly to a computer-implemented method for authenticating and authorizing a user identifier for accessing a service. The present invention further relates to an authentication and authorization system for authenticating and authorizing a user identifier for accessing a service, and a computer program product for authenticating and authorizing a user identifier for accessing a service. [Background technology]

[0002] Privacy and data security have always been very high on the priority list of corporate IT (information technology) departments. The use of two-factor authentication methods to authenticate users has become very common. Two-factor authentication has not only become a common standard for accessing banking applications, but is also used in many enterprise applications. For example, a user who wants to access a particular enterprise application must enter both a password and a code received separately on their smartphone.

[0003] As cloud computing services are widely used, access from one cloud service to another may be either not secure at all through application programming interfaces (APIs) or secured by simple authentication mechanisms. Cases where the access methods between one service and another, or to a cloud service through an API from a user identified using a user identifier, are more complex and reliable remain rare.

[0004] There are several disclosures that focus on the problem of more secure access between computing services. For example, the document US Patent Application Publication No. 2017 / 0161486A1 describes an API authentication method using two API tokens, including issuing a general API token to a user device and providing necessary information for a one-time API token. Furthermore, the document US Patent Application Publication No. 2009 / 0132807A1 discloses a method and apparatus for enabling a secure connection with an SSL / TSL enabled server (Secure Socket Layer, Transport Layer Security). In one embodiment, a web client establishes a new connection by initiating communication with the SSL / TSL enabled server. The communication includes a non-POST request. After negotiating a secure connection with the server in response to the non-POST request, the client sends a POST request to the SSL / TSL enabled server over the secure connection.

[0005] A drawback of known solutions may be that they are computationally expensive, highly complex to process, and may not be user-friendly.

[0006] Therefore, there may be a need to overcome these limitations and provide highly secure API-based access to services, e.g. cloud computing services. Summary of the Invention

[0007] According to one aspect of the invention, a computer-implemented method may be provided for authenticating and authorizing a user identifier for accessing a service, the service may be secured by an identity access management system, and the service may be invoked through a service application programming interface (API) that requires two-factor authorization to initiate execution of the service for the requesting user identifier.

[0008] The method may include receiving a service request through an application programming interface of the service, along with first data for a first authentication method and second data for a second authentication method, validating the first data as a first ID PassKey using the first authentication method, and validating the second data as a second ID PassKey using the second authentication method, wherein the first ID PassKey is used as an input to the second authentication method, and the second authentication method is different from the first authentication method.

[0009] The method may further include performing a service upon receiving both the first identity passkey and the second identity passkey being verified.

[0010] According to another aspect of the present invention, an authentication and authorization system may be provided that authenticates and authorizes a user identifier for accessing a service. The service may be secured by an identity access management system and may be invokable through an application programming interface of the service that requires two-factor authorization to initiate execution of the service for a requesting user identifier.

[0011] The system may include a processor and a memory communicatively coupled to the processor, the memory storing program code portions that, when executed, enable the processor to receive a service request along with first data for a first authentication method and second data for a second authentication method through an application programming interface of the service.

[0012] The processor may also be capable of verifying the validity of the first data as a first ID Passkey using a first authentication method and verifying the validity of the second data as a second ID Passkey using a second authentication method, the first ID Passkey being used as an input to the second authentication method, the second authentication method being different from the first authentication method, and performing the service upon receiving that both the first ID Passkey and the second ID Passkey have been verified.

[0013] The proposed computer-implemented method for authenticating and authorizing a user identity for accessing a service may provide many advantages, technical effects, contributions, and / or improvements.

[0014] In summary, embodiments of the present invention recognize that service invocation in cloud computing environments may be significantly enhanced. Today's techniques for invoking services using IAM (identity and access management) tokens or the ability to invoke services using IAM API keys as the only authentication method may be significantly improved. Embodiments may improve the operational reliability of public, hybrid and / or private cloud computing environments. Unauthorized access to services that handle sensitive data or that affect critical infrastructure components (e.g. the control of the power grid, gas supply systems, water supply networks or power plants) may be prevented even if the underlying computing technology is based on cloud computing principles. The improvement in security is obtained by the fact that access to publicly available services may only be granted using two authentication methods, which must be different and both authentication methods must be controlled by an IAM system.

[0015] Thus, two-factor / two-method authorization techniques, successfully implemented for example in accessing bank accounts or shopping portals, can now be used in the context of cloud computing, with the astonishing effect that the potential for abuse of publicly available services can be reduced by at least a factor of 100.

[0016] The method of two-factor authentication is generally at the discretion of the creator. However, preferred embodiments may include using a client certificate (i.e., the calling service's certificate) to implement the first authentication method. An IAM token or IAM API key may be used successfully as the second authentication method. The choice of authentication method may provide a variety of implementation options.

[0017] As a result, if an API can require two authentication attempts and only one is successful, the service called in the cloud computing environment will not begin executing (i.e., will not start or cannot be invoked).

[0018] Below, additional embodiments of the inventive concepts will be described, which apply equally to methods, computer program products, and systems.

[0019] According to a preferred embodiment of the method, the first authentication method can be based on a client security certificate. Furthermore, the second authentication method can be based on a security token or an application programming interface key. Generally, other combinations of authentication methods can also be used, but the above-described combination of this embodiment can allow a relatively uncomplicated implementation, starting from a security certificate of the client or client system. Furthermore, as the second authentication method, two alternatives may be considered, which can be advantageous for a possible creator.

[0020] According to another advantageous embodiment of the method, the first authentication method can use the mTLS (mutual transport layer security, or simply TLS for short) standard. Such an implementation can be realized using any version or any release of the mTLS standard. mTLS is widely used in the Zero Trust Security framework to verify users, devices, and servers within an organization. mTLS can therefore also be a good choice as a basic interfacing protocol for mutual authentication of APIs.

[0021] According to one embodiment of the method, the validation of the first and second data may be performed through an Identity Access Management (IAM) system. Both the first and second authentication methods may be secured by the same or different IAM systems, which may provide more implementation options for the proposed concept.

[0022] According to some embodiments of the method, the verifying of the first data and the verifying of the second data can be performed through the requested service or by a separate service communicatively in contact with the requested service. Such options can provide interesting implementation alternatives. The separate service can be an integrated part of the requested service (i.e., a service to be executed after authentication is established) or the separate service can be a stand-alone service that can be used by multiple different requested services.

[0023] According to one optional embodiment of the method, the client certificate may be generated from an identity access management system (e.g., may be created by an IAM system). Alternatively, according to another optional embodiment of the method, the client certificate may be created by a user and then uploaded. Thus, there may be various implementation options for the main method.

[0024] According to one improved embodiment of this method, the requested service may be integrated into a combined service such that a security services portion may be integrated into the combined service and may include an mTLS endpoint of the first authorization method.

[0025] According to one embodiment of the method, the security service may include an internal security service that authenticates via a token or an application programming interface key. Alternatively, an IAM system may be used for both authentication acts.

[0026] According to an optional embodiment of the method, the requested service may be executed in a cloud computing environment. This may be of particular interest to users who provide or request a large number of different cloud computing services in a hybrid cloud or multi-cloud environment. In such cases, the security and integrity of data and user access may be increased beyond security thresholds in order to comply with government regulations.

[0027] Furthermore, embodiments may take the form of a related computer program product accessible from a computer-readable storage medium providing program code for use by or in connection with any programmable instruction execution device or system. A computer-readable storage medium, in this description, may be any apparatus capable of providing means for storing, conveying, propagating or transferring a program for use by or in connection with a programmable instruction execution system, apparatus or device.

[0028] It should be noted that the embodiments of the present invention are described in relation to different subject matters. In particular, some embodiments are described in relation to method type claims, while other embodiments are described in relation to device type claims. However, a person skilled in the art will infer from the above and following descriptions that, unless otherwise specified, any combination of features belonging to one type of subject matter, as well as any combination of features relating to different subject matters, in particular any combination of features of method type claims and features of device type claims, will be construed as disclosed in this document.

[0029] The above-defined and further aspects of the present invention will become apparent from and will be explained with reference to the example embodiments to be described hereinafter, without being limited thereto.

[0030] Preferred embodiments of the invention will now be described, by way of example, with reference to the following drawings, in which: [Brief description of the drawings]

[0031] [Figure 1] FIG. 2 is a block diagram of one embodiment of a computer-implemented method of the present invention for authenticating and authorizing a user identity for accessing a service. [Figure 2a] FIG. 1 is a block diagram including known methods of accessing an API of a service. [Figure 2b] FIG. 1 is a block diagram including known methods of accessing an API of a service. [Diagram 3] FIG. 1 is a communication diagram showing the basic workings of the Mutual Transport Layer Security (mTLS) protocol. [Figure 4] FIG. 1 is a communication diagram showing the main communication flows of the components of the proposed concept. [Diagram 5] FIG. 1 is a block diagram of one embodiment of a system for authenticating and authorizing a user identity for accessing a service. [Figure 6]FIG. 6 illustrates an embodiment of a computing system according to FIG. 5. [Figure 7] FIG. 1 illustrates a cloud computing environment in which at least some of the concepts of the present invention may be implemented. [Figure 8] A diagram showing the components of a cloud computing environment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0032] In the context of this description, the following conventions, terms and / or expressions may be used:

[0033] The term "authenticating and authorizing" refers to a two-step process in which a calling or requesting entity must first establish a verified credential (i.e., authenticate), and then the authenticated entity can have authorization to access a particular resource (i.e., the requested service). As an example, a cloud computing environment may be used in which the first step involves verifying the validity of the requester. The first authentication verification step may be performed using an IAM API key or IAM token used in a TLS connection. In some embodiments, a policy enforcement point (PEP) may be able to intercept a user's access request and calls a policy decision point (PDP), which can evaluate the access request against an authorization policy and enforce the decision. In such an environment, a policy administration point (PAP) works with the PDP to manage the access authorization policy.

[0034] It may be added that the authentication method used herein should be structured such that the implementation does not require user intervention (i.e., the implementation of the authentication method does not require user input). Authentication factors may generally be used in the form of a username and password, an IAM token, an IAM API key, a client certificate, or an algorithm that can determine a time-based one-time password (TOTP) value from a stored secret.

[0035] The term "user identifier" can refer to a code (e.g., a UID) used to uniquely identify a user running an application, a computing device making a request to an API of a service (i.e., a service call), or a related service making a request to the API of another service. The use of a user identifier can be a means to explicitly manage access rights to a service (e.g., handling access to sensitive data).

[0036] The term "accessing a service" may refer to using an API to perform a service request from one service to another.

[0037] The term "identity access management system" (IAM system), also known as identity and access management (IdAM system), can be based on a policy and technology framework to ensure that the right users (within an enterprise) have appropriate access to technology resources. IdAM systems fall under the umbrella umbrella of information technology (IT) security and data management. Identity and access management systems identify, authenticate, and control not only the access of individuals to IT resources, but also the hardware and applications that employees need to access.

[0038] The term "Application Programming Interface" (API) describes a connection between computers or computer programs (i.e., services). An API can be a type of software interface that provides a service to another piece of software. A document or standard that describes how to build or use such a connection or interface is called an API specification.

[0039] The term "two-factor authentication" refers to the use of two distinct security methods before allowing access to a particular service (i.e., before a requesting service, or a user presenting a service request, is authorized to access or perform that service).

[0040] The term "service request" refers to a service invocation from another service.

[0041] The terms "first data" and "second data" refer to data used in the context of a first authentication method and a second authentication method, respectively.

[0042] The term "ID passkey" may be understood to be equivalent to first data in the context of a first authentication method and second data in the context of a second authentication method.

[0043] The term "client security credentials" refers to a code created by IAM or a calling service to verify the identity of the client.

[0044] The term "security token" refers to a code required to access a service, and the security token may be verified by an IAM system before the service can be executed.

[0045] The term "Application Programming Interface Key" (API Key) refers to a piece of code without which an API cannot be accessed (i.e., the API is secured by an API key). Thus, any service initiated by accessing an API will not be executed unless the correct API key is provided along with other parameters required by the API.

[0046] The term "mTLS standard" refers to the known Mutual Transport Layer Security (mTLS, or TLS for short). mTLS, as the protocol is known, is a cryptographic protocol designed to provide communications security over computer networks. Secure Sockets Layer (SSL) is a widely used successor to mTLS.

[0047] The term "cloud computing", and more specifically "cloud service environment", in the current context, can be interpreted as a model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. The cloud service environment model promotes availability and consists of at least five fundamental characteristics, three service models, and four deployment models.

[0048] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementations of the teachings described herein are not limited to a cloud computing environment. Instead, embodiments of the present invention may be implemented in conjunction with any other type of computing environment now known or later developed. Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing power, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. This cloud model may include at least five characteristics, at least three service models, and at least four implementation models.

[0049] The basic characteristics of cloud computing include: On-Demand Self-Service: Consumers can unilaterally and automatically provision computing resources, such as server time and network storage, as they need them, without the need for human interaction with each service provider. Broad network access: Resources and functionality are available across the network and are accessed through standard mechanisms that facilitate use from heterogeneous thin- and thick-client platforms (eg, cell phones, laptops, and PDAs). Resource pooling: A provider's computing resources are shared to serve multiple consumers using a multi-tenant model with various physical and virtual resources dynamically allocated and reallocated according to consumer demand. There is a location-independent notion in that the customer generally has no control or knowledge of the exact location of the resources provided, although the location may be identified at a higher level of abstraction (e.g. country, state, or data center). Examples of resources include storage, processing power, memory, network bandwidth, and virtual machines. Rapid elasticity: Computing resources can be quickly and elastically provisioned, sometimes automatically, to quickly scale out and quickly release to quickly scale in. To the consumer, the computing resources available for provisioning often appear unlimited, available for purchase in any quantity at any time. Measured Service: Cloud systems automatically control and optimize the resources used by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing power, bandwidth, user accounts using the service). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services used.

[0050] Service models that use cloud computing include the following: Software as a Service (SaaS): The service functionality provided to the consumer is the use of the provider's applications running on the cloud's infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application functions, except for possibly limited user-specific application configuration settings. Platform as a Service (PaaS): The service functionality provided to the customer is the implementation of applications created or acquired by the customer, written using programming languages ​​and tools supported by the provider, on the cloud's infrastructure. The customer does not manage or control the underlying cloud's infrastructure, including the network, servers, operating systems, or storage, but does control the implemented applications and, in some cases, the configuration of the environment that hosts the applications. Infrastructure as a Service (IaaS): The service capabilities provided to the Customer include the provision of processing power, storage, networking, and other underlying computing resources on which the Customer can deploy and run any software, which may include operating systems and applications. The Customer does not manage or control the underlying cloud infrastructure, but does control the operating systems, storage, deployed applications, and in some cases, limited control over selected networking components (e.g., host firewalls).

[0051] Cloud computing implementation models include: Private Cloud: The cloud infrastructure is operated solely by one organization. The cloud infrastructure may be managed by the organization or a third party and may be on-premise or off-premise. Community Cloud: The cloud infrastructure is shared by multiple organizations to support a community with shared concerns (e.g., mission, security requirements, policies, regulatory compliance considerations). The cloud infrastructure may be managed by the organization or a third party and may reside on-premise or off-premise. Public Cloud: The cloud infrastructure is available to the general public or large industry groups and is owned by an organization that sells cloud services. Hybrid Cloud: A cloud infrastructure consists of two or more clouds (private, community, or public) that remain their own entities but are bound together by standardized or proprietary technologies that make data and applications mobile (e.g., cloud bursting for load balancing between clouds).

[0052] Cloud computing environments are service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that consists of a network of interconnected nodes.

[0053] Note that cloud software takes full advantage of the cloud paradigm by being service-oriented, with a focus on statelessness (with exceptions), loose coupling, modularity, and semantic interoperability.

[0054] The figures will be described in detail below. All indications in the figures are schematic. Figure 1 shows a block diagram of one embodiment of a computer-implemented method of the present invention for authenticating and authorizing a user identity for accessing a given service. In the discussion of the following figures, aspects of additional embodiments of an authentication and authorization system for authenticating and authorizing a user identity for accessing a service will be described and depicted.

[0055] FIG. 1 illustrates a block diagram of a preferred embodiment of a computer-implemented method 100 for authenticating and authorizing a user identifier for accessing a service. The service is secured by an identity access management system and is invoked through the service's application programming interface (API), which requires two-factor authorization to initiate execution of the service for the requesting user identifier. For two-factor authorization, the preferred solution is based on an IAM token as well as a client certificate. The method 100 includes receiving a service request through the service's application programming interface (step 102). The request is received with first data for a first authentication method, which may be a client security certificate as previously described. The received request also includes second data for a second authentication method, which may be, for example, a security token in some embodiments.

[0056] The method 100 validates the first data using the first authentication method (step 104). In some embodiments, the method 100 uses an IAM system to validate that the first data exactly matches the first ID passkey for the first authentication method. In method step 106, the method validates the second data for a second authentication method, which may be validated using an IAM system utilizing a second ID passkey that is separate from the first ID passkey. In a two-factor authentication method, the validated and valid first ID passkey is used as an input to enable the second ID passkey for the second authentication method. The second authentication method is further distinct from the first authentication method.

[0057] Further, upon receiving and validating the first ID passkey and receiving and validating the second ID passkey, method step 108 initiates execution of the service and optionally delivers the results of the service to the requesting / calling service via a service API.

[0058] As background information, Figures 2a and 2b show two block diagrams 200a, 200b that include known methods of accessing APIs of services. Figure 2a shows a known method of invoking services 202, 204, 206, each of which has an API, from a requester 208. The requester 208 can access an IAM system 210 using an API key for an IAM access token and enter a service request using the API by verifying the IAM API key.

[0059] 2b illustrates a known implementation in which a requester 208 uses an IAM API key to access services 202, 204, 206, each of which has an API. The IAM API key can be verified by an IAM system 210.

[0060] 3 shows a communication diagram 300 illustrating the basic mechanism of the mTLS security protocol between a client 302 and a server 304, which can also be used as part of the two-factor authentication method proposed herein. The client 302 sends a synchronization signal 306 to the server 304. The server 304 sends a synchronization acknowledgement signal 308 back to the client 302. A client "hello" signal 310 and a server "hello" signal 312 are exchanged, the server hello signal 312 including the server hello completed certificate. The client 302 responds with a client_key-exchange signal 314 and receives a change_cypher_spec_finished signal 316 from the server.

[0061] According to this protocol, the server is required to identify itself by presenting its Secure Sockets Layer (SSL) certificate and must have the appropriate private key that is part of the SSL certificate. The client may optionally identify itself by presenting its SSL certificate and must have the appropriate private key that is part of the SSL certificate.

[0062] Figure 4 shows a communication diagram 400 illustrating the main communication flows of the components of the proposed concept. The components in Figure 4 include a client 302, a server service 304 including a TLS endpoint, and a server service 306 including an API implementation. The server services 304 and 306 may be separate services or the service TLS endpoint 304 may be integrated into the server service 306. The common dashed line around the server service 304 and the server service 306 indicates the possible integration of the two services.

[0063] The protocol begins by sending 312 an API request including an IAM token over mTLS. The server service with TLS endpoint 304 verifies 314 the client certificate with the IAM server 310 and establishes authentication / authorization ID1. The server service with TLS endpoint 304 then sends 316 an API request to the server service 306 including the IAM token and the authentication ID1 from the client certificate, where the API request includes a service request by the client 302. The server service 306 verifies 318 the IAM token, establishing authentication / authorization ID2.

[0064] The service 306 further performs 320 an authorization check 1 on IDs 1 and 2 to verify the authorization of IDs 1 and 2 for the first operation (i.e., verifying the authorization of either ID 1 or 2 for the operation of the “GET” command) and performs 322 another authorization check 2 on the remaining ID of IDs 1 and 2 for the second operation (i.e., the “CONNECT” command to authorize connection to the API to access the requested service). These two authorization checks indicate the actions of the PEP (discussed earlier). After verifying the authorization of the operation for both authentication IDs, the service 306 performs 324 the API operation to perform the requested service function. The server service 304 including the TLS endpoint receives 326 the results and sends 328 the results to the calling or requesting client 302 (or the service requested by the client 302).

[0065] An IAM-enabled service requires two authorizations to initiate a requested service: the first identity check checks and verifies that ID1 has an associated policy that allows the first action (i.e., (i) action "GET"); the second identity check checks and verifies that ID2 has an associated policy that allows the second action (i.e., "CONNECT"). IDs 1 and 2 function as the two-factor authentication / authorization component of an embodiment of the invention to authorize requests for services provided by the API.

[0066] 5 illustrates a block diagram of one embodiment of a method 500 for authenticating and authorizing a user identifier for accessing a service. The service is again secured by an identity access management system, and the service may be invoked by an application programming interface of the service that requests two-factor authorization to initiate execution of the service for the requesting user identifier. The system 500 includes a processor 502 and a memory 504 communicatively coupled to the processor 502, the memory storing program code portions that, when executed, enable the processor 502 to receive, through a receiver unit 506, a service request including first data for a first authentication method and second data for a second authentication method for accessing and receiving the requested service from the application programming interface of the service.

[0067] The processor 502 can further verify the validity of the first data, which is a first ID passkey, using a first authentication method via a first verifying unit 508, and verify the validity of the second data, which is a second ID passkey, using a second authentication method via a second verifying unit 510, whereby the first ID passkey together with the second data is used as an input to the second authentication method, which is different from the first authentication method.

[0068] Further, upon receiving the first ID pass key and the second ID pass key, as determined by the decision unit “all keys received?” 512, the processor 502 may further execute a service, specifically a service supported by the service execution module 514.

[0069] It should also be mentioned that all the functional units, modules, and functional blocks, specifically the processor 502, the memory 504, the receiver unit 506, the first verification unit 508, the second verification unit 510, the decision unit 512, and the service execution module 514, can be communicatively coupled to each other to exchange signals or messages in a selected one-to-one manner. The functional units, modules, and functional blocks can alternatively be linked to a system internal bus system 516 to selectively exchange signals or messages.

[0070] The embodiments of the present invention may be implemented in conjunction with virtually any type of computer platform, regardless of whether the platform is suitable for storing and / or executing program code. Figure 6 shows, as an example, a computing system 600 suitable for executing program code relating to the proposed method.

[0071] Computing system 600 is only one example of a suitable computer system, and whether computer system 600 can perform and / or execute any of the functions described above is not intended to suggest any limitation as to the scope of use or functionality of the embodiments of the invention described herein. There are components of computer system 600 that can operate in numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments, or configurations, or combinations thereof that may be suitable for use with computer system / server 600 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that comprise any of the above systems or devices. Computer system / server 600 may be described in the general context of computer system executable instructions, such as program modules, executed by computer system 600. Program modules may generally include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. Computer system / server 600 may operate in a distributed cloud computing environment where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0072] The computer system / server 600 is shown in the form of a general-purpose computing device. Components of the computer system / server 600 may include, but are not limited to, one or more processors or processing units 602, a system memory 604, and a bus 606 that couples various system components including the system memory 604 to the processor 602. The bus 606 may represent any one or more of several types of bus structures including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. Such architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnects (PCI) bus, by way of example only. Computer system / server 600 typically includes a variety of computer system readable media, which may be any available media that is accessible by computer system / server 600 and includes both volatile and nonvolatile media, removable and non-removable media.

[0073] The system memory 604 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 608 and / or cache memory 610. The computer system / server 600 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a storage system 612 may be provided for reading from and writing to a non-removable, non-volatile magnetic medium (not shown, commonly referred to as a "hard drive"). Although not shown, a magnetic disk drive may be provided for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive may be provided for reading from and writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical media. In such cases, each may be connected to the bus 606 by one or more data media interfaces. The memory 604 may include at least one program product having a set (e.g., at least one) of program modules configured to perform functions of embodiments of the present invention, as further illustrated and described below.

[0074] A program / utility having a set (at least one) of program modules 616, as well as, by way of example and not limitation, an operating system, one or more application programs, other program modules, and program data, may also be stored in memory 604. Each of the operating system, one or more application programs, other program modules, and program data, or any combination thereof, may include an implementation of a network environment. The program modules 616 generally perform the functions and / or sequence of methods of embodiments of the present invention as described herein.

[0075] The computer system / server 600 may also communicate with one or more external devices 618, such as a keyboard, a pointing device, a display 620, one or more devices that allow a user to interact with the computer system / server 600, or any device (e.g., a network card, a modem, etc.) that allows the computer system / server 600 to communicate with one or more other computing devices, or a combination thereof. Such communication may occur through an input / output (I / O) interface 614. The computer system / server 600 may also further communicate with one or more networks, such as a local area network (LAN), a wide area network (WAN), or a public network (e.g., the Internet), or a combination thereof, through a network adapter 622. The network adapter 622 may communicate with other components of the computer system / server 600 through a bus 606, as shown. It is understood that other hardware and / or software components, not shown, may be used in combination with the computer system / server 600. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archiving storage systems.

[0076] Additionally, the methods of the authentication and authorization system 500 for authenticating and authorizing user identities for accessing services may be implemented in the bus system 606 .

[0077] FIG. 7 illustrates a cloud computing environment 700 in which at least some of the concepts of the present invention may be implemented. A set of functional abstraction layers provided by the cloud computing environment is illustrated. It should be understood in advance that the components, layers, and functions illustrated in FIG. 7 are intended to be exemplary only, and the embodiments of the present invention are not limited thereto. As illustrated, the following layers and corresponding functions are provided: Hardware and software layer 702 includes hardware and software components. Examples of hardware components include mainframe 704, server 706, RISC (Reduced Instruction Set Computer) architecture-based server 708, blade server 710, storage device 712, network 714, and networking components 714. Software components include network application server software 716 and / or database software 718 in some embodiments.

[0078] The virtualization layer 720 provides an abstraction layer upon which the following examples of virtual entities may be provided: virtual servers 722, virtual storage 724, virtual networks 726, including virtual private networks, virtual applications and operating systems 728, and virtual clients 730.

[0079] Management layer 732, in one example, may provide the functionality described below. Resource provisioning 734 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 736 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of such resources. Such resources may include application software licenses, in one example. Security provides identity verification of cloud consumers and tasks as well as protection of data and other resources. User portal 738 provides consumer and system administrator access to the cloud computing environment. Service level management 740 provides allocation and management of cloud computing resources such that required service levels are met. Service level agreement (SLA) planning and fulfillment 742 provides pre-arrangement and procurement of cloud computing resources in anticipation of future requirements according to SLAs.

[0080] The workload layer 744 implements examples of functionality that can utilize a cloud computing environment. Examples of workloads and functionality that can be implemented by this layer include mapping and navigation 746, software development and lifecycle management 748, virtual classroom instructional delivery 750, data analytics processing 752, transaction processing 754, and other endpoint services or systems 756, such as the inventive concept of two-factor authentication and authorization for API service delivery as described herein (compare also FIG. 5, 500).

[0081] FIG. 8 illustrates components 800 of a cloud computing environment 802. The cloud computing environment 802 includes one or more cloud computing nodes 804 with which local computing devices used by cloud consumers, such as a personal digital assistant (PDA) or mobile phone 806, a desktop computer 808, a laptop computer 810, or an automobile computer system 812, or combinations thereof, can communicate. The nodes 804 can communicate with each other. The nodes can be physically or virtually grouped in one or more networks, such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or combinations thereof, as described above (not shown). The cloud computing environment 802 enables cloud consumers to provide infrastructure, platform, and / or software as a service without the need to maintain resources on a local computing device. It should be understood that the types of computing devices 804 shown in FIG. 8 are intended as examples only, and that the computing nodes 10 and cloud computing environment 802 can communicate with any type of computerized device through any type of network or network-addressable connection (e.g., using a web browser), or both.

[0082] The description of various embodiments of the present invention has been presented for illustrative purposes and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terms used in this specification are selected to best explain the principles of the embodiments, practical applications, or technical improvements to the technology found in the market, or to allow other skilled in the art to understand the embodiments disclosed herein.

[0083] The present invention may be embodied as a system, method, and / or computer program product, which may include a computer-readable storage medium (or media) having computer-readable program instructions that cause a processor to perform aspects of the present invention.

[0084] The medium may be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system for a propagation medium. Examples of a computer-readable medium may include a semiconductor or solid-state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk, and an optical disk. Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read / write (CD-R / W), DVD, and Blu-ray disk.

[0085] A computer readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or raised structures with instructions recorded in grooves, and any suitable combination of the foregoing. As used herein, computer-readable storage media, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted through wires, should not be construed as being transitory signals in and of themselves.

[0086] The computer readable program instructions described herein may be downloaded from the computer readable storage medium to the respective computing / processing device or to an external computer or storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may comprise copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface of each computing / processing device receives the computer readable program instructions from the network and forwards the computer readable program instructions for storage in the computer readable storage medium within the respective computing / processing device.

[0087] The computer readable program instructions for carrying out the operations of the present invention may be either source code or objects written in any combination of one or more programming languages, including assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or object-oriented programming languages, such as Smalltalk, C++, and traditional procedural programming languages, such as the C programming language or similar programming languages. The computer readable program instructions may be executed completely on the user's computer, as a stand-alone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In a scenario executed on a remote computer or server, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer readable program instructions by utilizing state information of the computer readable program instructions to dedicate the electronic circuitry to perform aspects of the invention.

[0088] Aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer readable program instructions.

[0089] Such computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing device for manufacturing machines, such that the instructions, executed by the processor of the computer or other programmable processing device, create means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. Such computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, programmable data processing device, or other device, or both, to function in a particular manner, such that the computer readable storage medium in which the instructions are stored can have an article of manufacture that includes instructions that perform aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0090] The computer-readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or another device, and cause the computer, other programmable apparatus, or other device to perform a series of operational steps to produce a computer-implemented process, such that the instructions, which execute on the computer, other programmable apparatus, or other device, perform the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0091] The flowcharts and / or block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or part of instructions, including one or more executable instructions, that implement the specified logical function. In some alternative implementations, the functions shown in the blocks may be performed out of the order shown in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may be executed in the reverse order, depending on the functionality required. It should also be noted that each block of the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be executed by a combination of dedicated hardware and computer instructions.

[0092] The terms used herein are for the purpose of describing particular embodiments only and are not intended to be limiting of the present invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that as used in this specification, the terms "comprises (third person singular present)" and / or "comprises (present participle)" specify the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups thereof, or combinations thereof.

[0093] The equivalents of the corresponding structures, materials, acts, and all means or steps and functional elements in the following claims are intended to include any structures, materials, or acts for performing a function in combination with other elements recited in the claims, specifically as recited in the claims. The description of the present invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the disclosed form of the invention. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. The embodiments have been selected and described in order to best explain the principles and practical application of the invention and to enable others skilled in the art to understand the invention in various embodiments with various modifications as suited to the particular use contemplated.

[0094] The inventive concept can be summarized by the following clauses. 1. A computer-implemented method for authenticating and authorizing a user identifier for accessing a service, the service being secured by an identity access management system and invokable through a service application programming interface that requires two-factor authorization to initiate execution of the service for a requesting user identifier, the method comprising: - receiving a service request by an application programming interface of the service together with first data for the first authentication method and second data for the second authentication method; - verifying the validity of the first data as a first ID passkey using a first authentication method; - validating the second data as a second ID PassKey using a second authentication method, the first ID PassKey being used as an input to the second authentication method, the second authentication method being different from the first authentication method; and - upon receiving the first ID passkey and the second ID passkey, executing the service; Includes. 2. The method according to clause 1, wherein the first authentication method is based on a client security certificate and the second authentication method is based on a security token or an application programming interface key. 3. The method of clause 1 or 2, wherein the first authentication method uses the mTLS standard. 4. The method according to any one of clauses 1 to 3, wherein verifying the validity of the first data and the second data is performed by an identity access management system. 5. The method of any of clauses 1 to 4, wherein verifying the first data and verifying the second data are performed by the requested service or by a separate service in communicative contact with the requested service. 6. The method according to any one of clauses 1 to 5, wherein the client certificate is generated from an identity access management system. 7. The method according to any one of clauses 1 to 6, wherein the client certificate is created by the user. 8. The method of any of clauses 1 to 7, wherein the target service is integrated into a combined service and the security services portion is integrated into the combined service and includes an mTLS endpoint of the first authorization method. 9. The method according to clause 8, wherein the security service further comprises an internal security service that authenticates via a token or an application programming interface key. 10. The method according to any of clauses 1 to 9, wherein the target service is performed in a cloud computing environment. 11. An authentication and authorization system for authenticating and authorizing a user identifier for accessing a service, the service being secured by an identity access management system, the service being invokable through a service application programming interface that requires two-factor authorization to initiate execution of the service for a requesting user identifier, the system comprising: - a processor; and a memory communicatively coupled to the processor. The memory, when executed, causes the processor to - A service request through the service's application programming interface; First data for a first authentication method; and Second data for a second authentication method and - verifying the validity of the first data as a first ID passkey using a first authentication method; - validating the second data as a second ID PassKey using a second authentication method, the first ID PassKey being used as an input to the second authentication method, the second authentication method being different from the first authentication method; - upon receiving the first ID passkey and the second ID passkey, executing the service; To store program code portions that enable 12. The system of clause 11, wherein the first authentication method is based on a client security certificate and the second authentication method is based on a security token or an application programming interface key. 13. The system of any one of clauses 11 to 12, wherein the first authentication method uses the mTLS standard. 14. The system of any of clauses 11 to 13, wherein verifying the validity of the first data and the second data is performed by an identity access management system. 15. A system as described in any of clauses 11 to 14, wherein verifying the first data and verifying the second data are performed by the requested service or by a separate service in communicative contact with the requested service. 16. The system of any of clauses 11 to 15, wherein the client certificate is generated from an identity access management system. 17. A system according to any of clauses 11 to 16, wherein the client certificate is created by a user. 18. The system of claim 11, wherein the target service is integrated into a combined service, and the security services portion is integrated into the combined service and includes an mTLS endpoint of the first authorization method. 19. The system according to clause 18, wherein the security service also includes an internal security service for authentication via a token or application programming interface key. 20. A computer program product for authenticating and authorizing a user identifier for accessing a service, the service being secured by an identity access management system and being invokable by a service application programming interface that requires two-factor authorization to initiate execution of the service for a requesting user identifier; A computer program product includes a computer-readable storage medium having program instructions embodied therein, the program instructions being executable by one or more computing systems or controllers, and causing one or more computing systems to - A service request through the service's application programming interface; First data for a first authentication method; and Second data for a second authentication method and receive it together with - verifying the authenticity of the first data as a first ID passkey using a first authentication method; - A second authentication method is used to verify the validity of the second data as a second ID PassKey, the first ID PassKey is used as input to the second authentication method, and the second authentication method is different from the first authentication method; and - upon receiving the first ID passkey and the second ID passkey, execute the service.

Claims

1. 1. A computer-implemented method of authenticating and authorizing a user identifier for access to a secure service through an identity access management system, the service being invoked through a service application programming interface that requires two-factor authorization to initiate execution of the service for the requesting user identifier, the method comprising: receiving, by one or more processors, a service request along with first data for a first authentication method and second data for a second authentication method, the service request engaging an application programming interface of the service; verifying, by the one or more processors, the authenticity of the first data as a first ID pass key using the first authentication method; validating, by the one or more processors, the second data as a second ID pass key using a second authentication method, the validated first ID pass key being included as an input to the second authentication method, the second authentication method being different from the first authentication method; performing the service in response to receiving, by the one or more processors, that the authenticity of both the first ID pass key and the second ID pass key has been confirmed; A method comprising:

2. 2. The method of claim 1, wherein the first authentication method and the second authentication method are selected from the group consisting of a client security certificate, a security token, and an application programming interface key, and the first authentication method is different from the second authentication method.

3. The method of claim 1 or 2, wherein the first authentication method uses the mutual Transport Layer Security (mTLS) standard.

4. The method of claim 1 , wherein verifying the validity of the first data and the second data is performed by an identity access management system.

5. 5. The method of claim 1, wherein verifying the validity of the first data and verifying the validity of the second data are performed by selecting from the group consisting of the requested service and a separate service in communicative contact with the requested service.

6. The method according to any one of claims 1 to 5, wherein a client security certificate is generated from an identity access management system and serves as an identity passkey.

7. The method of claim 6 , wherein the client security certificate is created by a user.

8. 8. The method of claim 1, wherein the requested service is a combined service and a security service is integrated into the combined service and includes an mTLS endpoint of the first authorization method.

9. 9. The method of claim 8, wherein the security services further include an internal security service that authenticates using a selection from the group consisting of a token and an application programming interface key.

10. The method of claim 1 , wherein the requested service is executed in a cloud computing environment.

11. 1. An authentication and authorization system for authenticating and authorizing a user identifier for accessing a secure service through an identity access management system, the service being invoked through a service application programming interface that requires two-factor authorization to initiate execution of the service for the requesting user identifier, the system comprising: one or more processors; one or more computer-readable storage media communicatively coupled to the one or more processors; wherein the one or more computer-readable storage media, when executed, cause the one or more processors to: receiving a service request together with first data for a first authentication method and second data for a second authentication method, the service request connecting with an application programming interface of the service; verifying the validity of the first data as a first ID pass key using the first authentication method; validating the second data as a second ID pass key using the second authentication method, the validated first ID pass key being included as an input to the second authentication method, the second authentication method being different from the first authentication method; performing the service in response to receiving the validation of both the first ID pass key and the second ID pass key; storing program code portions enabling said

12. 12. The system of claim 11, wherein the first authentication method and the second authentication method are selected from the group consisting of a client security certificate, a security token, and an application programming interface key, and the first authentication method is different from the second authentication method.

13. 13. The system of claim 11 or 12, wherein the first authentication method uses the mutual Transport Layer Security (mTLS) standard.

14. The system of claim 11 , wherein verifying the validity of the first data and the second data is performed by the identity access management system.

15. 15. The system of claim 11, wherein verifying the validity of the first data and the second data is performed by selecting from the group consisting of the requested service and a separate service in communicative contact with the requested service.

16. 16. The system of any one of claims 11 to 15, wherein a client security certificate is generated from an identity access management system and serves as an identity passkey.

17. The system of claim 16 , wherein the client certificate is created by a user.

18. 18. The system of claim 11, wherein the requested service is a combined service and a security service is integrated into the combined service and includes an mTLS endpoint of the first authorization method.

19. 20. The system of claim 18, wherein the security services also include an internal security service that authenticates through a token or an application programming interface key.

20. 1. A computer program product for authenticating and authorizing a user identity for accessing a service, the service being secured by an identity access management system and invoked by a service application programming interface that requires two-factor authorization to initiate execution of the service for the requesting user identity, the computer program product comprising: Computer-readable storage medium having embedded program instructions the program instructions being executable by one or more computer processors and causing the one or more computer processors to: receiving a service request together with first data for a first authentication method and second data for a second authentication method, said service request coupling with an application programming interface of said service; verifying the authenticity of the first data as a first ID pass key using the first authentication method; a second authentication method is used to validate the second data as a second ID pass key, and the validated first ID pass key is included as an input to the second authentication method, the second authentication method being different from the first authentication method; and in response to receiving the validation of both the first ID pass key and the second ID pass key, causing the service to be executed. Computer program products.

Images