US 10,873,587 B2 · Authenticating access configuration for application programming interfaces

Abstract

A system is configured to authorize client access to an application programming interface (API) of a host device. A proxy is configured to handle network traffic between a host and a client. Clients engage the host through the proxy to access an API of the host. An authorized client-side application permitted use of the API includes a Software Development Kit configured to generate a unique token and provide the token in association with an API request to the proxy. The proxy determines whether an internet protocol (IP) address of the client and the token match an existing IP-token pair. If no match exists, the proxy determines whether the token matches an existing token. The proxy authorizes the client access to the API when the IP and token match an existing pair or if the token does not match an existing token and the token is verified by the proxy.

Claims21

Dependent claims

A computer implemented method for authenticating a client device to access an application programming interface (API) of a host device by a proxy, the method comprising:

inspecting an API request received from the client device for a token associated with the API request and an internet protocol (IP) address associated with API request;
determining, in response to the API request including the token and the IP address, whether an existing verified IP address-token pair matches the IP address and the token combination associated with the API request;
verifying that the token and the IP address associated with the API request in response to the IP address and the token combination matches the existing verified IP address-token pair;
verifying a timestamp attribute of the token is within a threshold period of time from a current time;
verifying a truncated hash attribute of the token generated by the client device matches a truncated hash generated by the proxy from one or more of the attributes of the token, wherein the hash attribute is truncated based upon a character selection of the hash attribute to prevent a running of the hash through a hashing function in reverse in order to ascertain attributes of the token;
permitting the API request in response to verification of the token and the IP address associated with the API request;
and
transmitting the permitted API request to the host device for servicing.

5 more elements

A computer implemented method for authenticating a client device to access an application programming interface (API) of a host device by a proxy, the method comprising:

inspecting an API request received from the client device for a token associated with the API request and an internet protocol (IP) address associated with the client device;
determining, in response to the API request including the token and the IP address, whether an existing verified IP address-token pair matches the IP address and the token combination associated with the API request;
verifying the token based on attributes of the token in response to determining the existing verified IP address-token pair does not match the IP address and the token combination associated with the API request;
verifying a timestamp attribute of the token is within a threshold period of time from a current time;
verifying a truncated hash attribute of the token generated by the client device matches a truncated hash generated by the proxy from one or more of the attributes of the token, wherein the hash attribute is truncated based upon a character selection of the hash attribute to prevent a running of the hash through a hashing function in reverse in order to ascertain attributes of the token;
permitting the API request in response to verification of the token and the IP address associated with the API request;
storing a new verified IP address-token pair comprising the IP address associated with the client device stored in association with the token;
and
in response to storing the new verified IP address-token pair, transmitting the permitted API request to the host device for servicing.

6 more elements

A non-transitory computer readable storage medium storing computer program instructions configured for authenticating a client device to access an application programming interface (API) of a host device by a proxy, the instructions when executed by a processor causes the processor to:

inspect an API request received from the client device for a token associated with the API request and an internet protocol (IP) address associated with the client device;
in response to the API request including the token and the IP address, execute instructions that cause the processor to:
determine whether an existing verified IP address-token pair matches the IP address and the token combination associated with the API request;
in response to a determination that the IP address and the token combination associated with the API request lacks a match to the existing verified IP address-token pair, determine whether the existing verified IP address-token pair includes a matching token and IP address;
verifying a timestamp attribute of the token is within a threshold period of time from a current time;
verifying a truncated hash attribute of the token generated by the client device matches a truncated hash generated by the proxy from one or more of the attributes of the token, wherein the hash attribute is truncated based upon a character selection of the hash attribute to prevent a running of the hash through a hashing function in reverse in order to ascertain attributes of the token;
deny the API request in response to determining the IP address and the token combination associated with the API request lacks a match to the existing verified IP address-token pair and determining the existing verified IP address-token pair includes a matching token;
and
transmit a challenge to the client device in response to the denial of the API request.

6 more elements

A non-transitory computer readable storage medium storing computer program instructions configured for authenticating a client device to access an application programming interface (API) of a host device, the computer program instructions when executed by one or more processors of a proxy server device causing the processors of the proxy to:

inspect an API request received from the client device for a token associated with the API request and an internet protocol (IP) address associated with the client device;
in response to the API request including the token and the IP address, determine whether an existing verified IP address-token pair matches the IP address and the token combination associated with the API request;
verify the token and the IP address associated with the API request in response to the IP address and the token combination matches the existing verified IP address-token pair;
verify a timestamp attribute of the token is within a threshold period of time from a current time;
verify a truncated hash attribute of the token generated by the client device matches a truncated hash generated by the proxy from one or more of the attributes of the token, wherein the hash attribute is truncated based upon a character selection of the hash attribute to prevent a running of the hash through a hashing function in reverse in order to ascertain attributes of the token;
permit the API request in response to verification of the token and the IP address associated with the API request;
and
transmit the permitted API request to the host device for servicing.

5 more elements

A non-transitory computer readable storage medium storing computer program instructions configured for authenticating a client device to access an application programming interface (API) of a host device, the computer program instructions when executed by one or more processors of a proxy server device causing the processors of the proxy to:

inspect an API request received from the client device for a token associated with the API request and an internet protocol (IP) address associated with the client device;
in response to the API request including the token and the IP address, determine whether an existing verified IP address-token pair matches the IP address and the token combination associated with the API request;
verify the token based on attributes of the token in response to determining the existing verified IP address-token pair does not match the IP address and the token combination associated with the API request;
verify a timestamp attribute of the token is within a threshold period of time from a current time;
verify a truncated hash attribute of the token generated by the client device matches a truncated hash generated by the proxy from one or more of the attributes of the token, wherein the hash attribute is truncated based upon a character selection of the hash attribute to prevent a running of the hash through a hashing function in reverse in order to ascertain attributes of the token;
permit the API request in response to verification of the token associated with the API request;
store a new verified IP address-token pair comprising the IP address of the client device stored in association with the token;
and
in response to storing the new verified IP address-token pair, transmitting the permitted API request to the host device for servicing.

6 more elements

Dependencies are inferred from the claim text.

Authenticating access configuration for application programming interfaces

Life of this patent

Authenticating access configuration for application programming interfaces

Life of this patent

Abstract

Claims21