Server-Controlled Client Authorization Proof for Token Authenticity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web security systems face challenges in securely managing client authorization due to the separation of authentication and authorization sub-systems, leading to vulnerabilities in verifying the authenticity of authorization tokens, which can be exploited by pirates for unauthorized access.
Innovation Solution
Implementing a server-controlled client authorization proof of possession system that provisions keys and a secure time base on the server side, ensuring that client devices can generate authorization proof tokens that are verifiable by servers, thus enhancing security against cloning attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If separate authentication and authorization sub-systems are used, then business entities can be separated (authentication by subscription seller, authorization by CDN), but the authorization sub-system cannot verify the authenticity of tokens issued by the authentication sub-system
Solution Approach 1:
The patent introduces a proof of possession token as an intermediary mechanism between the authentication and authorization sub-systems. This token contains a digital signature created by the authentication sub-system using its private key, allowing the authorization sub-system to verify the token's authenticity through the corresponding public key without needing direct trust relationships or frequent communications between the separated business entities.
2Reliability
If frequent authorizations are performed to protect against unauthorized access, then security is improved, but user experience deteriorates due to repeated authentication requirements
Solution Approach 1:
The patent implements proof of possession verification as a preliminary security check that occurs independently of user authentication. The proof of possession token is verified automatically by the authorization sub-system before processing authorization requests, allowing frequent security checks without requiring users to re-authenticate, thus maintaining security while preserving user experience.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Techniques for server control of client authorization proof of possession are described herein. In various embodiments, a first server provisions client authorization proof of possession for a client device a real-world time, a client public key, and a client private key. The first server generates provisioning response message(s) including the client public key, the client private key, the real -world time, and/or an assertion object, and sends the message(s) to the client device. In various embodiments, a client device obtains an authorization proof token generated based on a client public key, a client private key, and a real-world time provisioned by a first server. The client device generates a request and sends the request to a second server, the request includes the authorization proof token and an assertion object from the first server signed by a server private key and an expiration time and a reference to the client public key.