API Request Validation Using Resource Owner ID Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In wireless communication systems, malicious API invokers can bypass authorization mechanisms, compromising resource access security by using traditional TLS-PSK/PKI-based authorization without a resource owner identity or by not obtaining tokens with owner IDs, thus allowing unauthorized access to resources.
Innovation Solution
Implement a method where a first entity rejects requests that carry a resource owner ID without a token or a token that does not include the owner ID, returning a rejection response to prevent unauthorized access, thereby enhancing resource access security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional TLS-PSK/PKI-based authorization mechanism is used, then authorization can be performed, but resource access security is compromised because the token does not include resource owner ID
Solution Approach 1:
The patent segments the authorization mechanism into two distinct parts: traditional TLS-PSK/PKI-based authorization for basic access control, and SNA-based authorization for resource owner-specific control. By separating these functions, the system can maintain both mechanisms without letting the simpler traditional mechanism compromise security when used alone.
Solution Approach 2:
The patent introduces a token as an intermediary element that carries resource owner ID information. This token acts as a mediator between the API invoker and the resource, ensuring that even when using traditional authorization mechanisms, the resource owner's identity is preserved and can be verified, thus preventing security compromises.
2Reliability
If SNA authorization mechanism is used, then resource owner identity is included in token, but the system becomes more complex when both mechanisms are used together
Solution Approach 1:
The patent applies local quality by making the token structure adaptable - when SNA authorization is used, the token includes resource owner ID for accurate authorization; when traditional authorization is used, the token follows the conventional structure. This allows each mechanism to operate with its appropriate characteristics without forcing uniform complexity throughout the system.
Solution Approach 2:
The patent introduces dynamic behavior to the authorization system where the first entity can switch between different authorization mechanisms based on the request context. The system dynamically adjusts which mechanism to apply (traditional or SNA) and how to validate the token, allowing flexibility that manages complexity while maintaining high authorization accuracy when needed.
3Ease of operation
If the first entity accepts requests with resource owner ID but without proper token validation, then request processing is simplified, but security is compromised
Solution Approach 1:
The patent applies preliminary action by validating the token's resource owner ID against the request's resource owner ID before allowing access. This preliminary validation step prevents malicious requests from slipping through, while the validation process itself remains integrated into the standard request processing flow, maintaining operational simplicity.
Solution Approach 2:
The patent implements feedback by having the first entity return rejection responses to requests that fail authorization validation. This feedback mechanism provides clear security boundaries while maintaining simple processing - the entity simply rejects requests that don't meet the authorization criteria without requiring complex analysis or additional processing steps.
Data Source
Figure 1~3
Figure 4~5
Figure 6~7
AI summary
Disclosed in embodiments of the present application are a request processing method and device, which can be applied to the technical field of communications. The method comprises: upon receipt of a first request satisfying a first condition, a first entity can reject the first request, wherein the first condition is that the first request carries a first resource owner identifier and does not carry a token; or the first condition is that the first request carries the first resource owner identifier and carries a token which does not comprise the resource owner identifier. In this way, malicious API callers are prevented from requesting to access, without the authorization of resource owners, resources of the resource owners by means of the first request, thereby improving the security of resource access.