Authentication Token with Client Key for Secure Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Token-based authentication systems are vulnerable to unauthorized access due to the susceptibility of tokens being stolen and replayed, as they do not ensure that the presenter of the token is the original intended user, and existing protocols require additional checks and resource-intensive processes.
Innovation Solution
Incorporating a client public key into authentication tokens and using a proof-of-possession (POP) token, which is validated by the service provider using the identity provider's public key, ensuring that only the authorized client can access secure services, eliminating the need for external validation and reducing resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional token-based authentication is used, then users can access multiple servers after a single login, but tokens are susceptible to being stolen and presented for unauthorized access
Solution Approach 1:
The patent introduces a trusted identity server as an intermediary that validates tokens before granting access. The identity server acts as a mediator between the client and service providers, verifying token authenticity and preventing unauthorized access even if tokens are stolen. This resolves the contradiction by maintaining single-login convenience while adding a security layer that prevents token misuse.
Solution Approach 2:
The system implements feedback mechanisms where service providers continuously validate tokens with the identity server during the authentication process. The identity server provides real-time feedback on token validity, enabling dynamic security checks that prevent stolen tokens from being used for unauthorized access while maintaining seamless user experience.
2Reliability
If tokens are validated by calling trusted identity servers, then unauthorized access is prevented, but additional resource-intensive processes are required
Solution Approach 1:
The identity server performs preliminary validation of tokens during the initial authentication process and caches validation results. Service providers can then use these pre-validated tokens without requiring continuous real-time validation calls, reducing computing resource consumption while maintaining security. The preliminary action of validating tokens upfront prevents the need for repeated resource-intensive verification processes.
Data Source
AI summary
Techniques are described for using two tokens to request access to a secure server. The tokens allow the server to verify, without an external call, that the requesting device is one identified in the request and that the requesting device is authorized by a trusted identity provider. A first token is an authentication token issued by the trusted identity provider and including a client device public key. The second token is a proof-of-possession token that is signed by a client device using a client device private key corresponding to the client device public key. The server obtains the client device public key from the authentication token, and then uses the client device public key to validate the proof-of-possession token. The authentication token can be re-used by a server creating its own proof-of-possession token for presentation to a second server to access a secure service on the second server.