Decentralized Identity Fabric Blockchain for API Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing API security implementations face challenges in maintaining shared secrets across a large network of resources and applications, leading to operational difficulties, security risks, and increased complexity due to the need for multiple secret management and potential single points of failure.
Innovation Solution
The use of a decentralized identity fabric blockchain for authenticating client applications, which generates and stores decentralized identifiers and public key pairs, eliminating the need for shared secrets and providing a single representation of identity, thereby reducing credential management and eliminating single points of failure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shared secrets are used for authentication between calling applications and authorization servers, then authentication can be established, but operational complexity and security risks increase significantly when managing multiple secrets across large networks
Solution Approach 1:
The patent extracts the secret management problem by introducing a dedicated secret management service that centralizes the generation, distribution, and rotation of secrets. This service acts as a specialized component that handles all secret-related operations, removing the burden from individual applications and authorization servers. The secret management service maintains secure storage, automated rotation, and audit logging capabilities that would be difficult to implement across a distributed system.
Solution Approach 2:
The patent merges multiple secret management functions into a unified system. The secret management service combines key generation, secure storage, distribution to multiple authorization servers, rotation coordination, and audit logging into a single integrated component. This consolidation reduces operational complexity by providing a single point of management for all secrets across the distributed authorization infrastructure.
2Adaptability or versatility
If multiple authorization servers maintain separate secrets and tokens for each calling application, then each server can independently authenticate requests, but the ecosystem complexity grows and operational responsibility becomes complex and manual
Solution Approach 1:
The patent implements a universal secret management service that serves all authorization servers and calling applications through a standardized interface. This service provides multi-functional capabilities including secret generation, secure distribution to multiple servers, automated rotation, and centralized auditing. The universal service eliminates the need for each authorization server to independently manage secrets, reducing ecosystem complexity while maintaining independent authentication capabilities.
Solution Approach 2:
The secret management service acts as an intermediary between calling applications and multiple authorization servers. It mediates the secret distribution process by securely providing secrets to authorized servers without exposing them in transit or storage. The service also mediates rotation operations by coordinating updates across all servers simultaneously, preventing the complexity that would arise from manual coordination.
3Ease of operation
If secrets are manually managed through admin consoles and distributed to calling applications, then access control can be established, but the process is challenging and exposes secrets to security risks
Solution Approach 1:
The patent implements self-service capabilities where the secret management service automatically generates secrets, distributes them to authorized authorization servers, and rotates them without manual intervention. Calling applications can programmatically request secret updates through standardized APIs. This automation eliminates the need for manual admin console operations and reduces the risk of secret exposure that occurs during manual copying and pasting of credentials.
Solution Approach 2:
The patent replaces the manual mechanical process of secret management (copying, pasting, storing in source code) with an automated electronic system. The secret management service uses programmatic interfaces, secure encrypted channels, and automated rotation schedules to manage secrets. This substitution eliminates the human error and security risks associated with manual secret handling while maintaining ease of operation through standardized APIs.
4Ease of operation
If secrets are stored in source code or credentials files, then the application can access them, but errors frequently happen where secrets are exposed and security is compromised
Solution Approach 1:
The patent extracts secrets from source code and credential files by introducing a dedicated secret management service. Applications no longer embed secrets in their codebase; instead, they retrieve secrets programmatically from the centralized service through secure APIs. This extraction eliminates the security vulnerability of having secrets visible in source control or stored in plain-text credential files on application servers.
Solution Approach 2:
The secret management service acts as an intermediary that provides secrets to applications through secure programmatic interfaces. Instead of applications directly accessing secrets from files or environment variables, they request them from the service which provides them through authenticated API calls. This intermediary layer prevents secret exposure in source code and ensures secrets are transmitted through encrypted channels with proper access controls.
Data Source
AI summary
Methods and apparatuses are described for authenticating client applications using an identity fabric blockchain. A server receives a first registration request from a first client application. The server generates a first decentralized identifier corresponding to the first client application and stores the first identifier in an identity fabric blockchain. The server receives a second registration request from a second client application, generates a second decentralized identifier corresponding to the second client application, and stores the second identifier in the blockchain. The server receives a first authentication request from a first resource and authenticates the first client application based on the first authentication request and the first decentralized identifier stored in the blockchain. The server receives a second authentication request from a second resource and authenticates the second client application based on the second authentication request and the second decentralized identifier stored in the blockchain.