Resource Server Token Verification Key Update Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In conventional OAuth systems, resource servers face increased load and performance issues due to frequent token verifications and information queries made to authentication/authorization servers, especially when new private key-public key pairs are added, leading to invalid signature verification if the resource server is not notified and does not hold the corresponding public key.
Innovation Solution
An information processing apparatus and method that allows a resource server to verify signed tokens by obtaining and holding new key information from a server providing key information, enabling verification even if the resource server is not notified of key additions, by using a holding unit to store key information and an obtainment unit to retrieve new keys as needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the resource server verifies all access tokens by querying the authentication/authorization server, then token verification reliability is improved, but the load on the authentication/authorization server increases and resource server performance deteriorates
Solution Approach 1:
The resource server performs preliminary actions by obtaining and storing public key information from the authentication/authorization server before token verification is needed. This allows the server to verify token signatures locally without querying the authentication server for each token, reducing load and improving performance while maintaining verification reliability.
2Reliability
If the authentication/authorization server adds new private key-public key pairs for security, then security is improved, but the resource server cannot verify tokens signed with new keys if it is not notified
Solution Approach 1:
The resource server implements a feedback mechanism by periodically querying the authentication/authorization server for updated public key information. When new key pairs are added to the authentication server, the resource server can obtain these updates through subsequent queries, ensuring it can verify tokens signed with new keys without requiring explicit notification mechanisms.
Solution Approach 2:
The resource server performs preliminary key acquisition by obtaining public keys from the authentication server in advance and storing them locally. This preliminary action ensures that when new keys are added to the authentication server, the resource server can retrieve them through subsequent queries and use them for verification, enabling adaptability to key updates.
3Measurement precision
If the resource server makes frequent verification queries to the authentication server, then token verification accuracy is improved, but the number of queries increases and system load increases
Solution Approach 1:
The resource server extracts the essential verification capability by obtaining public key information from the authentication server and storing it locally. This extraction allows the server to perform token signature verification independently without needing to query the authentication server for each token, reducing the number of queries while maintaining verification accuracy through local cryptographic verification.
Data Source
AI summary
According to the present invention, an information processing apparatus that verifies a signed token is provided. The apparatus comprises a holding unit for holding key information for verifying the signed token, an obtainment unit for obtaining new key information from a server that provides the key information, and holding the new key information in the holding unit, if the key information for verifying a received signed token is not held in the holding unit, and a verification unit for verifying the signed token using the key information if the key information for verifying the received signed token is held in the holding unit.