Token-Based API Authorization with Signed License Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for accessing application program interfaces (APIs) in distributed computing environments are inefficient and require complex cryptographic routines, making them vulnerable to tampering and unauthorized access.
Innovation Solution
A method and system utilizing a digitally signed license token with an unencrypted payload and appended digital signature, verified through hash value matching, to generate a Security Assertion Markup Language (SAML) token for authorization, ensuring secure and efficient access to APIs without the need for traditional credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cryptographic authentication methods are used for API access, then security is improved, but system complexity and computational overhead increase significantly
Solution Approach 1:
The patent applies preliminary action by pre-generating and embedding digital signatures into license tokens during the licensing phase, rather than performing cryptographic operations at the time of API access. The tokens contain pre-computed hash values and digital signatures that are validated simply by comparing against the presented token, eliminating the need for complex real-time cryptographic routines during authentication.
2Reliability
If complex cryptographic verification routines are implemented, then tampering detection is improved, but processing time and computational resources increase
Solution Approach 1:
The patent uses copying by creating simplified copies of cryptographic verification - instead of performing full cryptographic validation, the system copies the essential verification function by comparing pre-computed hash values embedded in tokens against newly computed hashes of presented tokens. This maintains tampering detection capability while dramatically reducing computational overhead and processing time.
3Ease of operation
If traditional authentication credentials are used, then access control is achieved, but vulnerability to unauthorized access and credential theft increases
Solution Approach 1:
The patent extracts the essential authentication function from traditional credential systems by removing the need for secret credentials, passwords, or certificates. Instead, it extracts only the necessary verification element - a digitally signed token with a hash that can be publicly validated. This eliminates vulnerability to credential theft while maintaining access control, as the verification mechanism does not rely on secret information that could be compromised.
Data Source
AI summary
Technologies for token-based access authorization to an application program interface (API) include an access management server to receive a service request message from an application executed by a remote computing device. The service request message includes a digitally signed license token previously generated by the access management server and distributed to the remote computing device. The service request message also includes a request from the executed application to access data or a service of the resource server via an exposed API. The access management server verifies the digital signature of the digitally signed license token and generates a digitally signed Security Assertion Markup Language (SAML) token. The digitally signed SAML token is transmitted to the resource server for verification and local caching. The resource server receives the service request message and determines whether access to the requested data or service is authorized based on the locally-cached SAML token.