Multi-Party Digital Signatures for API Request Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for securing API requests are vulnerable to unauthorized access due to the potential breach of API tokens and secrets, especially in cross-entity API services, where an adversary can mimic a legitimate user once they gain access to these sensitive information.
Innovation Solution
Implementing multi-party digital signatures by splitting the API secret into shares, which are generated and stored by different systems, allowing only validated shares to sign API requests without revealing any share to other parties, ensuring that the API secret remains secure and cannot be reconstructed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If API tokens and secrets are used for cryptographic authentication, then request authentication is enabled, but security vulnerabilities arise when the system is breached
Solution Approach 1:
The API secret is segmented into multiple secret shares distributed across different systems. No single system holds the complete secret, so even if one system is breached, the adversary cannot reconstruct the full secret to authenticate requests. This directly resolves the contradiction by maintaining authentication reliability while eliminating the single-point security vulnerability.
Solution Approach 2:
A multi-party computation protocol acts as an intermediary mechanism that enables joint signing of API requests without any party revealing their secret share. The protocol mediates the authentication process so that the complete secret never exists in one location, thereby maintaining authentication functionality while preventing breach exploitation.
2Ease of operation
If the complete API secret is stored in one system, then signing operations are simplified, but the secret becomes vulnerable to exposure upon system breach
Solution Approach 1:
The secret is divided into multiple shares stored in different systems. While this increases operational complexity compared to single-system storage, it eliminates the catastrophic risk of secret exposure. The multi-party computation protocol automates the coordination, making the segmented approach as operationally feasible as centralized storage while providing superior security.
3Object-affected harmful factors
If secret shares are distributed among multiple systems, then security against breach is improved, but system complexity increases
Solution Approach 1:
The multi-party computation protocol serves as an intermediary that manages the complexity of coordinating multiple systems. It provides standardized interfaces and automated coordination mechanisms, so while the underlying architecture is more complex, the operational complexity is managed through the protocol layer. This resolves the contradiction by accepting necessary architectural complexity to achieve security while managing operational complexity through automation.
Data Source
AI summary
A system and method for securing application programming interface (API) requests using multi-party digital signatures. The method includes generating, by a first system, at least one first secret share of a plurality of secret shares based on an API secret, wherein the plurality of secret shares includes the at least one first secret share and at least one second secret share, wherein the at least one second secret share is generated by at least one second system; and signing, by the first system, an API request using the at least one first secret share, wherein the API request is further signed by the at least one second system using the at least one second secret share, wherein the API request is signed without revealing any of the at least one first secret share to the at least one second system and without revealing any of the at least one second secret share to the first system.