Protected API Access via Credential Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional software platforms lack adequate mechanisms to protect application programming interfaces (APIs) from unauthorized access, particularly for third-party applications that do not belong to trusted security domains, leading to potential misuse of user data and system operations.
Innovation Solution
Implementing a protected API system that uses public keys for verification and a credential storage manager to maintain permission and certificate information, allowing access to protected APIs based on trusted credentials, and providing a controlled permission level to restrict access to sensitive APIs, with mechanisms for reauthorization and certificate management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional security domains are used to control API access, then trusted applications can access protected APIs, but third-party applications cannot access any protected APIs even when they should be permitted
Solution Approach 1:
The patent extracts the security verification mechanism from the rigid security domain structure and implements it as an independent credential verification system. The Application Authorization Manager separately verifies developer credentials and maintains a trusted applications list, allowing third-party applications to access protected APIs based on individual credential verification rather than domain membership.
Solution Approach 2:
The patent segments the security model into distinct components: credential storage manager for credential management, application authorization manager for verification, and protected API interfaces for controlled access. This segmentation allows flexible permission assignment to individual applications regardless of security domain boundaries.
2Reliability
If public key verification is implemented for API access control, then unauthorized access is prevented, but additional verification steps increase access time
Solution Approach 1:
The patent performs credential verification in advance during application installation and registration phases. The Application Authorization Manager verifies developer credentials and maintains an updated trusted applications list before runtime API access is needed, so that actual API calls only require checking against the pre-verified list rather than performing full public key verification each time.
Solution Approach 2:
The patent creates a copy of the verified credential information in the trusted applications list, which can be quickly referenced during runtime API access without requiring the original complex public key verification process. This copy contains essential authorization information that speeds up runtime access while maintaining security.
Data Source
AI summary
Mechanisms are provided to allow particular parties and applications access to protected application programming interfaces (APIs) without the use of security domains. Trusted parties and applications may have access to protected APIs while unfrosted parties and applications may be restricted to a more limited set of APIs. Public keys associated with individual applications that are used to enforce licensing policies can be repurposed for use in a verification process to prevent unauthorized access to APIs. A credential storage manager can be used to maintain permission and certificate information. An application authorization manager may access credential storage and maintain trusted application information.