Proof-of-Possession Token Binding Access to TLS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Device users often need to repeatedly provide credentials to access protected resources, which can be inconvenient while compromising security, as existing solutions like encrypted communication and bearer tokens do not adequately ensure proof of possession of private keys.
Innovation Solution
Implementing proof-of-possession (PoP) tokens within the OAuth 2.0 framework, where a client obtains a PoP token from an authorization server, allowing it to demonstrate possession of a private key without exposing the key, using a confirmation key to bind access tokens to TLS connections, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users provide credentials repeatedly to access protected resources, then security is maintained through authentication, but user convenience deteriorates due to frequent login requirements
Solution Approach 1:
The system performs preliminary authentication by issuing a proof-of-possession token after initial credential verification. This token enables subsequent resource access without requiring repeated credential entry, thus maintaining security while improving convenience.
Solution Approach 2:
The proof-of-possession token acts as an intermediary credential between the user's private key and the protected resources. It allows the system to verify possession of the private key without exposing the key itself, resolving the contradiction between security and convenience.
2Ease of operation
If bearer tokens are used for access control, then user convenience improves by eliminating repeated authentication, but security deteriorates because stolen tokens can be freely used
Solution Approach 1:
The system replaces the traditional bearer token mechanism with a proof-of-possession token that uses cryptographic signatures. Instead of relying on token secrecy, it uses mathematical proof of private key possession, substituting a cryptographic mechanism for the mechanical bearer token approach.
Solution Approach 2:
The proof-of-possession token serves as a secure intermediary that binds the access authorization to the user's private key through cryptographic signatures, preventing unauthorized use even if the token is intercepted.
3Ease of operation
If private keys are exposed for authentication, then access control functionality is achieved, but security deteriorates due to key exposure risks
Solution Approach 1:
The system extracts the authentication function from the private key itself. Instead of using the private key directly for authentication, it uses a proof-of-possession token that contains only the necessary verification information, separating the key storage from the authentication process.
Solution Approach 2:
The proof-of-possession token acts as an intermediary that enables authentication without exposing the private key. It contains a cryptographic signature that proves key possession while keeping the key itself hidden, resolving the contradiction between functionality and security.
Data Source
AI summary
A client computing device may obtain access to protected resources with a proof-of-possession (Pop) token. The client computing device may request an access token from an authorization server via an application server. The request may include key material (e.g., token binding type, key, and key parameters) that the client computing device possesses or has access to, such as a public key of an asymmetric public/private key pair. In some embodiments, the public key may be a confirmation (CNF) key, which may be added to the access token and JWT signed by the authorization server. The private key may be retained by the client, who may then use the PoP token to prove possession of the private key.