Token-Based API Authorization Using Signed License and SAML Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for accessing application program interfaces (APIs) in distributed computing environments are inefficient and require complex cryptographic routines, making them prone to tampering and unauthorized access.
Innovation Solution
A method using digitally signed license tokens with unencrypted payloads and appended digital signatures, verified through hash value matching, generates a Security Assertion Markup Language (SAML) token for authorization, enabling secure and efficient access management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cryptographic authentication methods are used, then security is provided, but system complexity and computational overhead increase
Solution Approach 1:
The patent extracts the security verification function from complex cryptographic routines by using digitally signed tokens with unencrypted payloads. The signature verification is separated from the main authentication flow, allowing the system to maintain security while reducing computational complexity in the primary authentication path.
Solution Approach 2:
The patent changes the parameter of credential structure by using tokens with unencrypted payloads containing claim data. This allows verification to focus only on the digital signature rather than decrypting and validating complex encrypted credential structures, thereby reducing computational overhead while maintaining security.
2Productivity
If digitally signed tokens with unencrypted payloads are used, then verification efficiency is improved, but vulnerability to tampering increases
Solution Approach 1:
The patent applies preliminary anti-action by pre-computing and embedding hash values of the payload in the digital signature before the token is transmitted. This pre-established cryptographic binding prevents tampering because any modification to the unencrypted payload would invalidate the signature verification, thus countering the tampering risk before it can occur.
Solution Approach 2:
The patent introduces hash values as an intermediary mechanism between the unencrypted payload and the digital signature verification. The hash acts as a mediator that links the payload content to the signature, enabling efficient verification while maintaining integrity protection against tampering.
3Reliability
If complex authentication protocols are implemented, then access control security is enhanced, but processing time increases
Solution Approach 1:
The patent implements preliminary action by pre-signing tokens with embedded hash values during token generation. This allows the receiving system to perform rapid verification by simply comparing the embedded hash with a newly computed hash of the payload, eliminating the need for time-consuming decryption and complex validation protocols while maintaining strong security guarantees.
Data Source
AI summary
Technologies for token-based access authorization to an application program interface (API) include an access management server to receive a service request message from an application executed by a remote computing device. The service request message includes a digitally signed license token previously generated by the access management server and distributed to the remote computing device. The service request message also includes a request from the executed application to access data or a service of the resource server via an exposed API. The access management server verifies the digital signature of the digitally signed license token and generates a digitally signed Security Assertion Markup Language (SAML) token. The digitally signed SAML token is transmitted to the resource server for verification and local caching. The resource server receives the service request message and determines whether access to the requested data or service is authorized based on the locally-cached SAML token.