License Token Authentication With Cached SAML API Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for accessing application program interfaces (APIs) in distributed computing environments are inefficient and require complex cryptographic routines, making them prone to tampering and unauthorized access.
Innovation Solution
A method and system utilizing a digitally signed license token with an unencrypted payload and appended digital signature, verified by an access management server, to generate a Security Assertion Markup Language (SAML) token for authorized access to APIs, eliminating the need for traditional credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cryptographic authentication methods are used for API access, then security is improved, but system complexity and computational overhead increase
Solution Approach 1:
The patent applies preliminary action by pre-generating and embedding digital signatures into license tokens during the licensing phase. These tokens are then cached by resource servers, eliminating the need for complex real-time cryptographic verification during API authentication. The signature verification is performed in advance and stored for efficient lookup.
Solution Approach 2:
The patent uses copying by creating cached copies of verified license tokens and their digital signatures on resource servers. Instead of performing full cryptographic verification for each API request, the system copies the verification result and token data to local cache, enabling fast authentication without repeated complex cryptographic operations.
2Reliability
If complex cryptographic verification is performed for each API request, then authentication reliability is improved, but processing speed decreases
Solution Approach 1:
The system performs cryptographic verification in advance by pre-signing license tokens with digital signatures. The access management server verifies these signatures once during token issuance and caches the results, so that subsequent API requests can be authenticated using the cached verification data without repeating complex cryptographic operations.
Solution Approach 2:
The patent implements beforehand cushioning by pre-computing and storing digital signatures and verification data in caches. This preparatory cushioning of computational work ensures that when API requests arrive, authentication can proceed rapidly using pre-prepared verification data, protecting against speed degradation from repeated cryptographic operations.
3Reliability
If digital signatures are encrypted with private keys, then token integrity is improved, but verification complexity increases
Solution Approach 1:
The patent applies self-service by enabling resource servers to independently verify license token signatures using cached public keys and verification data. Each resource server maintains its own cache of valid token signatures and can autonomously verify incoming tokens without requiring continuous communication with the access management server, simplifying the verification process.
Solution Approach 2:
The system simplifies verification complexity by copying public keys and signature verification data from the access management server to local caches on resource servers. This allows resource servers to perform verification using local copies of cryptographic materials rather than requiring complex real-time communication with the central authority for each verification operation.
4Reliability
If traditional authentication credentials are used, then security is maintained, but ease of operation decreases
Solution Approach 1:
The patent extracts the complex credential verification process from the authentication flow by separating the license token (which contains the signature) from the verification logic. The license token is embedded in the application once and then reused for multiple API calls, extracting the heavy cryptographic work from the authentication path and replacing it with simple token presentation and cache lookup operations.
Solution Approach 2:
The system improves ease of operation by performing authentication setup in advance - license tokens are generated and cached before actual API usage. This preliminary action means that during normal operation, applications can simply present their license tokens without undergoing complex authentication rituals, making the operational experience simpler while maintaining strong security through the pre-established cryptographic foundation.
Data Source
AI summary
Technologies for token-based access authorization to an application program interface (API) include an access management server to receive a service request message from an application executed by a remote computing device. The service request message includes a digitally signed license token previously generated by the access management server and distributed to the remote computing device. The service request message also includes a request from the executed application to access data or a service of the resource server via an exposed API. The access management server verifies the digital signature of the digitally signed license token and generates a digitally signed Security Assertion Markup Language (SAML) token. The digitally signed SAML token is transmitted to the resource server for verification and local caching. The resource server receives the service request message and determines whether access to the requested data or service is authorized based on the locally-cached SAML token.