API Proxy Authentication Using IP-Token Pair Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for protecting application programming interfaces (APIs) from unauthorized access are inadequate, particularly due to the limitations of lightweight data-interchange formats like WebSocket and JSON, which lack robust authentication mechanisms, leading to issues such as illegitimate access and denial of service attacks.
Innovation Solution
Implementing a proxy server with a software development kit (SDK) that generates and verifies tokens for authorized client applications, allowing only authenticated clients to access the API through a WebSocket, while blocking unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If IP level rate limiting is used to protect APIs, then the time it takes to scrape a host is increased, but legitimate users sharing the same IP address are severely impacted
Solution Approach 1:
The patent segments the identification of clients from IP address level to application level by extracting and verifying client application identifiers (package names, bundle IDs, or executable file names) from API requests. This segmentation allows differentiation between legitimate and illegitimate users sharing the same IP, resolving the contradiction by enabling targeted rate limiting only for malicious clients while preserving access for legitimate ones.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism that extracts client application identifiers from API requests and verifies them against a whitelist of authorized applications. This intermediary layer sits between the IP-level rate limiting and the actual API access, enabling fine-grained control that protects against scraping while allowing legitimate users to proceed unimpeded.
2Measurement precision
If traditional protection methods relying on fully featured interchange formats are used, then granular client identification is improved, but the efficiency of lightweight data-interchange formats like WebSocket and JSON is reduced
Solution Approach 1:
The patent applies partial action by extracting only the necessary client application identifier from the API request without requiring full authentication handshakes or heavy protocol overhead. This partial verification approach provides sufficient client identification precision while maintaining the efficiency of lightweight data-interchange formats, avoiding the performance penalty of traditional fully featured interchange formats.
3Object-affected harmful factors
If IP address blocking is used to prevent unauthorized access, then access by illegitimate users is captured, but legitimate users accessing from the same IP are also blocked
Solution Approach 1:
The patent segments the authentication process from IP-based to application-based identification, enabling differentiation between legitimate and illegitimate clients at the application level. This segmentation replaces coarse-grained IP blocking with fine-grained application identifier verification, allowing precise blocking of unauthorized applications while preserving access for authorized ones sharing the same IP address.
Solution Approach 2:
The patent implements feedback by verifying client application identifiers against a whitelist of authorized applications and providing appropriate responses. Legitimate applications receive authentication success and continued access, while illegitimate applications receive authentication failure and are blocked. This feedback mechanism enables selective access control that prevents unauthorized access without impacting legitimate users.
Data Source
AI summary
A system is configured to authorize client access to an application programming interface (API) of a host device. A proxy is configured to handle network traffic between a host and a client. Clients engage the host through the proxy to access an API of the host. An authorized client-side application permitted use of the API includes an API request to the proxy. The proxy determines whether an internet protocol (IP) address of the client and the token match an existing IP-token pair. If no match exists, the proxy determines whether the token matches an existing token. The proxy authorizes the client access to the API when the IP and token match an existing pair. In response to determining that the token exists in a token store but the token is associated with a different IP address, the API request may be denied.