API Gateway Authentication via Client Certificates and JWT Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Payment networks face challenges in ensuring the security and authenticity of messages transmitted across their systems, particularly in protecting sensitive data from unauthorized access, as existing encryption techniques and security hierarchies may not adequately address continuous authentication needs.
Innovation Solution
The implementation of a multi-level authentication system where client and computing device certificates are appended to messages, validated through local and global repositories, and security tokens are generated to ensure secure access to backend servers, leveraging API gateways and global access managers to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption techniques and security hierarchies are employed to protect sensitive data, then data security is improved, but continuous authentication capability deteriorates
Solution Approach 1:
The authentication process is segmented into multiple distinct levels: transport-level authentication via TLS certificates and application-level authentication via JWT tokens. Each segment handles specific authentication needs independently, allowing continuous verification at different stages of message transmission and processing without relying on a single authentication mechanism.
Solution Approach 2:
JWT tokens serve as an intermediary mechanism that bridges transport-level security and application-level authentication. The token carries authentication claims that can be verified independently of the underlying TLS connection, enabling continuous authentication capability while maintaining encryption-based security protections.
2Reliability
If multi-level authentication with certificate appending is implemented, then authentication reliability is improved, but message processing complexity increases
Solution Approach 1:
Authentication certificates and JWT tokens are appended to messages in advance during the outbound message creation process. This preliminary action ensures that all necessary authentication credentials are embedded before message transmission, eliminating the need for complex real-time authentication queries and reducing processing complexity at receiving endpoints.
Solution Approach 2:
The message structure is designed to be self-contained with all authentication credentials (TLS certificates and JWT tokens) embedded within the message itself. Receiving systems can independently verify authentication without requiring external authentication services or complex coordination, simplifying the overall processing architecture.
Data Source
AI summary
Networks and methods for use in authenticating messages are provided. One exemplary method generally includes receiving a message from a client, where the message includes a client certificate. The method also includes validating, by an application programming interface (API) gateway, a computing device based on a certificate identifying the computing device as a recognized computing device, and validating, by the API gateway, the client based on the client certificate via a global access manager, separate from the repository. The method further includes causing a security token indicative of the client to be generated, when the computing device and the client are validated, whereby the security token is indicative of the client and permits the message, from the client, to be delivered to one or more backend services.