API Access Keys With Separate User Authorization for Phishing Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication systems for APIs rely on single-factor trust, leading to security vulnerabilities such as password compromise and unrestricted access, making it difficult to revoke access to individual third parties without affecting all, and are susceptible to attacks like phishing.
Innovation Solution
A method and system that issue unique keys specific to applications, users, and devices, requiring separate user authorization transactions to activate access, with multiple layers of security including application and customer data keys, ensuring controlled access even on untrustworthy platforms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional authentication models are used where clients share resource owner credentials, then access to protected resources is enabled, but security is compromised and credentials must be stored
Solution Approach 1:
The authentication system is segmented into separate components: a resource owner authentication system and a client authentication system. The resource owner authenticates once to obtain credentials, which are then used by multiple clients without requiring the resource owner to re-authenticate or share credentials directly with each client. This segmentation eliminates the need to store and manage multiple sets of credentials while maintaining security.
Solution Approach 2:
A credential issuance mechanism acts as an intermediary between the resource owner and clients. The system issues credentials to clients based on resource owner authentication, serving as a mediator that enables client access without requiring direct credential sharing between the resource owner and each client. This intermediary layer provides both security and ease of operation.
2Ease of operation
If applications gain broad access to resource owner protected resources, then access capability is improved, but the ability to restrict access to individual third parties is lost
Solution Approach 1:
The access control system is made dynamic by allowing the resource owner to selectively issue credentials to specific clients based on trust relationships. The system can adapt access rights in real-time - enabling or disabling access for individual clients without affecting others. This dynamic control maintains broad access capability when needed while providing precise control when required.
Solution Approach 2:
Access rights are assigned with local quality - each client receives credentials with specific scope and validity parameters tailored to their individual trust relationship with the resource owner. The system supports different access levels for different clients simultaneously, allowing fine-grained control over who can access what resources and under what conditions.
3Ease of operation
If single-factor authentication is used, then authentication process is simplified, but the system becomes susceptible to phishing and credential compromise
Solution Approach 1:
The system performs preliminary authentication of the resource owner before issuing any credentials to clients. This preliminary action establishes a secure foundation - only after verifying the resource owner's identity through robust authentication does the system proceed to issue credentials. This preliminary verification layer prevents phishing and credential compromise by ensuring the authenticating entity is indeed the legitimate resource owner.
4Speed
If credentials are stored for future use, then access speed is improved, but security weaknesses are introduced
Solution Approach 1:
The system uses disposable, single-use credentials that are valid only for their intended purpose and then automatically expire. Instead of storing permanent credentials, the system issues credentials with limited validity periods and specific scopes. This approach provides fast access during the valid period while eliminating long-term security risks associated with stored credentials. The credentials are effectively disposable - used once and discarded.
Data Source
AI summary
A system and method for providing access to data of a user or services relevant to a user. A customer data key is created by a server that is specific to an application, the user of the application, and the device upon which the application resides. The server may receive an application programming interface call to create the customer data key; however, any call accessing or affecting user-specific data which does not contain a valid and authorized customer data key may be rejected. To authorize the access to the offered data or services, the user conducts an entirely separate transaction not mediated by the application. During this separate transaction, the customer data key may be activated, permitting access to the data or services using the activated customer data key.