Device-Bound PKI Credentials for OAuth Refresh Token Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The OAuth process lacks proof that refresh tokens are being presented from the device to which they were originally issued, making it difficult for the authentication server to distinguish between compromised and legitimate token presentations.
Innovation Solution
The solution involves using device-bound Public Key Infrastructure (PKI) credentials to sign OAuth refresh tokens, ensuring that the signing operation can only take place on the device where the grant was initially established, thereby verifying the token's origin.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional OAuth refresh tokens are used without device binding, then ease of operation is improved (tokens can be refreshed from any device), but security deteriorates (tokens can be misused on unauthorized devices)
Solution Approach 1:
The system performs preliminary device binding by generating and storing a device-specific key pair during initial authentication. The public key is registered with the authorization server before the refresh token is issued, creating a pre-established trust relationship that will validate future token presentations.
Solution Approach 2:
A cryptographic signature mechanism is introduced as an intermediary between the refresh token and the authorization server. The signature, created using the device-bound private key, serves as a mediator that proves the token's origin without requiring the token itself to be bound to device identifiers.
2Reliability
If device-bound PKI credentials are implemented to sign refresh tokens, then authentication confidence is improved, but device complexity increases
Solution Approach 1:
The system extracts the cryptographic verification logic from the device and relocates it to the authorization server. The device only needs to perform the relatively simple signing operation, while the complex verification of signatures and validation of public keys are handled by the server, reducing the computational burden on the device.
Solution Approach 2:
The system changes the cryptographic parameters by using asymmetric encryption (public-private key pairs) instead of symmetric encryption. This allows the device to use its private key for signing while the server verifies using the corresponding public key, enabling secure verification without requiring the device to store or manage complex cryptographic state.
Data Source
AI summary
A method allows access to computer resources to authorized native applications on a client device. An authorization server receives, from a native application on a device, an initial authorization grant, a public key of a private/public key pair generated on the device, and an attestation of authenticity of the native application. The authorization server receives, from the native application on the device, a refresh token and a digital signature of the refresh token that is created with the private key. The authorization server recognizes the refresh token only if the refresh token is verified with the public key that has been previously registered. The authorization server validates the digital signature of the refresh token, and transmits a new access token and a new refresh token to the native application on the device, thus allowing the native application on the device to access the computer resource.