Sender Constrained Token Issuance via Client Public Key Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The OAuth2.0 implicit flow's use of bearer tokens poses security risks due to potential token leakage, as there is no mechanism to ensure the access token is only usable by the intended client.
Innovation Solution
An information processing apparatus generates and issues a sender constrained token (proof-of-possession token) using a client-generated public key, ensuring the access token is securely tied to the client and can only be used by the client that requested it, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a bearer token is issued to the client according to OAuth2.0 implicit flow, then the client can directly receive and use the access token, but the security is compromised because the token may be leaked and used by unauthorized parties
Solution Approach 1:
The patent applies local quality by binding the access token to specific client characteristics (public key, nonce, client information) rather than creating a generic bearer token. This means the token has different properties for different clients, with each token being locally optimized for its intended recipient's security context. The token includes client-specific identifiers and cryptographic bindings that make it uniquely suited for that particular client, thereby improving security while maintaining the direct issuance mechanism.
2Device complexity
If a standard bearer token is used, then the authentication flow is simple and direct, but the token can be used by any party that obtains it, creating security vulnerabilities
Solution Approach 1:
The patent applies preliminary action by requiring the client to generate and include its public key and a cryptographic signature of its information in the token issuance request before receiving the access token. The server verifies these preliminary cryptographic proofs before issuing the token. This preliminary binding action ensures that even if the token is leaked later, it cannot be used by unauthorized parties because the token is cryptographically bound to the original client's identity and public key, thereby mitigating token leakage risk without significantly complicating the authentication flow.
Data Source
AI summary
According to an embodiment, an information processing apparatus issues an access token in response to a token issuance request from a client. The information processing apparatus includes one or more processors configured to: receive the token issuance request from the client, the token issuance request including a nonce issued to the client, a first public key generated by the client, and a first signature for client information including the nonce; transmit, to the client, a login request including first identification information of the token issuance request, when the first signature of the token issuance request is successfully verified, using the first public key; and generate and issue a sender constrained token with the first public key as the access token, upon receipt of an authorization permission request from the client, the authorization permission request including the first identification information and authentication information of a user who uses the client.