Local Access Token Verification Using Resource Server Key IDs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems face challenges in efficiently revoking access tokens without increasing compute overhead, leading to security risks and inefficient resource access management due to shared tokens and fixed expiration times.
Innovation Solution
A method that extracts a key identification from an access token, compares it against locally stored cryptographic keys, and verifies the token without requiring introspection checks at authorization servers, allowing for efficient revocation and access management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access tokens are shared between different clients to allow easy access to resources, then ease of operation is improved, but security is worsened due to inability to revoke tokens efficiently
Solution Approach 1:
The system performs preliminary actions by issuing cryptographic keys to resource servers before access tokens are shared. These keys are stored locally at resource servers in advance, enabling immediate verification capability when tokens are shared across multiple clients, thus maintaining security while allowing easy token sharing
Solution Approach 2:
Cryptographic keys serve as an intermediary mechanism between the authorization server and resource servers. Instead of requiring direct communication with the authorization server for each token verification, the cryptographic keys mediate the verification process locally at resource servers, enabling efficient token revocation without increasing compute overhead
2Reliability
If introspection checks are performed at authorization servers for token verification, then reliability is improved, but device complexity and compute overhead are worsened
Solution Approach 1:
The verification capability is extracted from the authorization server and placed locally at resource servers in the form of cryptographic keys. This extraction eliminates the need for resource servers to perform complex introspection checks at the authorization server, reducing device complexity while maintaining verification reliability through local key-based validation
Solution Approach 2:
Resource servers perform self-service verification using locally stored cryptographic keys instead of relying on the authorization server for each verification. This self-service approach reduces the computational burden on the authorization server and simplifies the overall system architecture while maintaining accurate token verification
3Ease of operation
If fixed expiration times are used for access tokens, then ease of operation is improved, but security is worsened due to inability to revoke tokens before expiration
Solution Approach 1:
The system introduces dynamics by allowing cryptographic keys to be updated or revoked at the authorization server at any time, independent of token expiration. This dynamic key management enables flexible token revocation before expiration, enhancing security while maintaining the simplicity of fixed expiration times for automatic token invalidation
Data Source
AI summary
A method, according to one approach, includes: receiving an access request targeting a first resource server. Moreover, a request is sent to an authorization server for an access token associated with performing the access request. The method also includes causing a key identification (ID) to be extracted from the requested access token received from the authorization server. The key ID is compared against cryptographic keys previously received at the first resource server. In response to the key ID matching one of the cryptographic keys previously received at the first resource server, the matching previously received cryptographic key is used to verify the access token. Moreover, in response to the access token being verified, causing the access request to be granted.