Proxy-Based Web IAM for Anonymous API Calls and Token Renewal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web applications face challenges in managing complex authentication processes and maintaining security artifacts, leading to increased vulnerabilities and resource consumption, while existing solutions require extensive code modifications and integration efforts.
Innovation Solution
Implementing network proxies that handle identity and access management by redirecting user authentication requests, storing access tokens, and automatically managing token retrieval and insertion, allowing web applications to issue anonymous API calls, thus simplifying security management and reducing code complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web applications implement authentication processes and manage security artifacts directly, then security control is improved, but code complexity and vulnerability likelihood increase
Solution Approach 1:
The patent introduces an outgoing network proxy as an intermediary component that sits between the web application and external APIs. This proxy handles all authentication processes and security artifact management, allowing the web application to make anonymous API calls without embedding security logic in its code, thus reducing code complexity while maintaining security control.
Solution Approach 2:
The authentication and security artifact management functions are extracted from the web application code and relocated to the outgoing network proxy. This extraction eliminates the need for the web application to maintain security artifacts, reducing vulnerability surface area while preserving security functionality.
2Reliability
If web applications manage security artifacts directly, then authentication control is improved, but computational resource consumption increases
Solution Approach 1:
The outgoing network proxy serves as a computational intermediary that handles token retrieval, validation, and insertion operations. By offloading these resource-intensive tasks from the web application to the proxy, the system reduces overall computational resource consumption while maintaining strong authentication control.
3Reliability
If existing authentication solutions are implemented, then access management is improved, but integration effort and code modifications increase
Solution Approach 1:
The outgoing network proxy acts as a drop-in intermediary that transparently handles authentication for existing API calls. Web applications can continue making anonymous API calls without modification, and the proxy automatically inserts appropriate tokens, eliminating the need for code changes while achieving robust access management.
Solution Approach 2:
The outgoing network proxy provides universal authentication handling that works across multiple APIs and services. A single proxy implementation manages authentication for various web applications and external services, reducing the need for separate authentication integration efforts for each system.
4Reliability
If access tokens are managed manually in web applications, then token control is improved, but vulnerability likelihood increases
Solution Approach 1:
Token management responsibilities are extracted from web application code and consolidated into the outgoing network proxy. The proxy handles token retrieval, storage, validation, and renewal operations, eliminating the need for web applications to store or manage tokens directly, thus reducing vulnerability surface area while maintaining secure token control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques described herein are directed to proxies configured to handle identity and access management for a web application. For instance, a first proxy receives requests to the application from a browser. The first proxy redirects the browser to an identity endpoint, which prompts the user to enter authentication credentials for the application. Upon successful authentication, the endpoint provides an access token for accessing web APIs to the first proxy. The first proxy provides the token to a second proxy, which stores the token. The second proxy receives anonymous API calls from the web application to the web APIs. When receiving an anonymous API call, the second proxy obtains the token and inserts it into an outgoing request to the API. Responsive to the API returning a message indicating that the token is invalid, the second proxy communicates with the first proxy to obtain a new token from the endpoint.