# US 10,873,587 B2 · Authenticating access configuration for application programming interfaces

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,873,587 B2
- Document ID: US10873587B2
- Status: Granted
- Kind: B2
- Application number: 15/933,127
- Filed: 2018-03-22
- Published: 2018-09-27
- Granted: 2020-12-22
- Earliest claimed: 2017-03-27
- Assignees: Oracle Systems Corporation
- Applicants: Oracle Systems Corporation
- Inventors: Leon Kuperman; Jose Hernandez
- Web page: https://patentgrep.com/patent/US10873587B2

## CPC

- H04L 63/123: {received data contents, e.g. message integrity}
- G06F 8/30: Creation or generation of source code
- G06F 21/33: using certificates
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/629: {to features or functions of an application}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/3236: {using cryptographic hash functions}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3271: {using challenge-response}
- H04L 63/0281: {Proxies}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- H04W 12/069: using certificates or pre-shared keys
- H04W 12/08: Access security
- H04W 12/122: Counter-measures against attacks; Protection against rogue devices
- H04L 2463/121: Timestamp
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A system is configured to authorize client access to an application programming interface (API) of a host device. A proxy is configured to handle network traffic between a host and a client. Clients engage the host through the proxy to access an API of the host. An authorized client-side application permitted use of the API includes a Software Development Kit configured to generate a unique token and provide the token in association with an API request to the proxy. The proxy determines whether an internet protocol (IP) address of the client and the token match an existing IP-token pair. If no match exists, the proxy determines whether the token matches an existing token. The proxy authorizes the client access to the API when the IP and token match an existing pair or if the token does not match an existing token and the token is verified by the proxy.

## Claims

### Claim 1

A computer implemented method for authenticating a client device to access an application programming interface (API) of a host device by a proxy, the method comprising:
inspecting an API request received from the client device for a token associated with the API request and an internet protocol (IP) address associated with API request;
determining, in response to the API request including the token and the IP address, whether an existing verified IP address-token pair matches the IP address and the token combination associated with the API request;
verifying that the token and the IP address associated with the API request in response to the IP address and the token combination matches the existing verified IP address-token pair;
verifying a timestamp attribute of the token is within a threshold period of time from a current time;
verifying a truncated hash attribute of the token generated by the client device matches a truncated hash generated by the proxy from one or more of the attributes of the token, wherein the hash attribute is truncated based upon a character selection of the hash attribute to prevent a running of the hash through a hashing function in reverse in order to ascertain attributes of the token;
permitting the API request in response to verification of the token and the IP address associated with the API request; and
transmitting the permitted API request to the host device for servicing.

### Claim 2 (depends on 1)

The method of claim 1, further comprising, in response to the IP address and the token combination matches an existing verified IP address-token pair, updating a number of API requests serviced for the matching existing verified IP address-token pair.

### Claim 3 (depends on 2)

The method of claim 2, further comprising, in response to the number of API requests serviced for the existing verified IP address-token pair reaching a threshold limit of API requests to service, purging the IP address and/or token to force the client device to provide a new token for verification.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
maintaining a time-to-live associated with the matching verified IP address-token pair; and
verifying the token associated with the API request in response to the IP address and the token combination matching the existing verified IP address-token pair if the time-to-live is not expired.

### Claim 5 (depends on 4)

The method of claim 4, further comprising purging, in response to the time-to-live associated with the matching verified IP address-token pair expiring, purging at least one of the IP address and the token to force the client device to provide a new token for verification.

### Claim 6

A computer implemented method for authenticating a client device to access an application programming interface (API) of a host device by a proxy, the method comprising:
inspecting an API request received from the client device for a token associated with the API request and an internet protocol (IP) address associated with the client device;
determining, in response to the API request including the token and the IP address, whether an existing verified IP address-token pair matches the IP address and the token combination associated with the API request;
verifying the token based on attributes of the token in response to determining the existing verified IP address-token pair does not match the IP address and the token combination associated with the API request;
verifying a timestamp attribute of the token is within a threshold period of time from a current time;
verifying a truncated hash attribute of the token generated by the client device matches a truncated hash generated by the proxy from one or more of the attributes of the token, wherein the hash attribute is truncated based upon a character selection of the hash attribute to prevent a running of the hash through a hashing function in reverse in order to ascertain attributes of the token;
permitting the API request in response to verification of the token and the IP address associated with the API request;
storing a new verified IP address-token pair comprising the IP address associated with the client device stored in association with the token; and
in response to storing the new verified IP address-token pair, transmitting the permitted API request to the host device for servicing.

### Claim 7 (depends on 6)

The method of claim 6, wherein verifying the token based on attributes of the token further comprises:
generating, by the proxy, a first hash from one or more first attributes of the token;
comparing the first hash to a second attribute of the token; and
verifying the token if the first hash generated by the proxy matches the second attribute, where the second attribute is a second hash generated by the client device.

### Claim 8 (depends on 6)

The method of claim 6, wherein verifying the token based on attributes of the token comprises:
decrypting the token with a private encryption key, the private encryption key corresponding to a public encryption key available to the client device for encrypting tokens; and
reading the attributes of the token in response to decrypting the token with the private encryption key.

### Claim 9 (depends on 8)

The method of claim 8, wherein the verifying of the token further comprises:
determining that the API request targets the host API;
retrieving the private encryption key associated with the host API; and
decrypting the token associated with the API request in response to retrieving the private encryption key associated with the host API targeted by the API request.

### Claim 10 (depends on 6)

The method of claim 6, wherein attributes of the token comprise a unique user identifier.

### Claim 11 (depends on 6)

The method of claim 6, further comprising:
in response to the IP address and the token combination associated with the API request lacking a match to the existing verified IP address-token pair, determining whether the existing verified IP address-token pair includes a matching token; and
verifying the token based on the attributes of the token in response to determining the existing verified IP address-token pair does not include a matching token.

### Claim 12

A non-transitory computer readable storage medium storing computer program instructions configured for authenticating a client device to access an application programming interface (API) of a host device by a proxy, the instructions when executed by a processor causes the processor to:
inspect an API request received from the client device for a token associated with the API request and an internet protocol (IP) address associated with the client device;
in response to the API request including the token and the IP address, execute instructions that cause the processor to:
determine whether an existing verified IP address-token pair matches the IP address and the token combination associated with the API request;
in response to a determination that the IP address and the token combination associated with the API request lacks a match to the existing verified IP address-token pair, determine whether the existing verified IP address-token pair includes a matching token and IP address;
verifying a timestamp attribute of the token is within a threshold period of time from a current time;
verifying a truncated hash attribute of the token generated by the client device matches a truncated hash generated by the proxy from one or more of the attributes of the token, wherein the hash attribute is truncated based upon a character selection of the hash attribute to prevent a running of the hash through a hashing function in reverse in order to ascertain attributes of the token;
deny the API request in response to determining the IP address and the token combination associated with the API request lacks a match to the existing verified IP address-token pair and determining the existing verified IP address-token pair includes a matching token; and
transmit a challenge to the client device in response to the denial of the API request.

### Claim 13 (depends on 12)

The non-transitory computer readable storage medium of claim 12, wherein the challenge transmitted to the client device is a non-standard HTTP response.

### Claim 14

A non-transitory computer readable storage medium storing computer program instructions configured for authenticating a client device to access an application programming interface (API) of a host device, the computer program instructions when executed by one or more processors of a proxy server device causing the processors of the proxy to:
inspect an API request received from the client device for a token associated with the API request and an internet protocol (IP) address associated with the client device;
in response to the API request including the token and the IP address, determine whether an existing verified IP address-token pair matches the IP address and the token combination associated with the API request;
verify the token and the IP address associated with the API request in response to the IP address and the token combination matches the existing verified IP address-token pair;
verify a timestamp attribute of the token is within a threshold period of time from a current time;
verify a truncated hash attribute of the token generated by the client device matches a truncated hash generated by the proxy from one or more of the attributes of the token, wherein the hash attribute is truncated based upon a character selection of the hash attribute to prevent a running of the hash through a hashing function in reverse in order to ascertain attributes of the token;
permit the API request in response to verification of the token and the IP address associated with the API request; and
transmit the permitted API request to the host device for servicing.

### Claim 15 (depends on 14)

The non-transitory computer readable storage medium of claim 14, further comprising computer program instructions configured to cause the processors of the proxy to, in response to the IP address and the token combination matching an existing verified IP address-token pair, update a number of API requests serviced for the matching the existing verified IP address-token pair.

### Claim 16 (depends on 15)

The non-transitory computer readable storage medium of claim 15, further comprising computer program instructions configured to cause the processors of the proxy to purge from storage the existing IP address and/or token to force the client device to provide a new token for verification, in response to the number of API requests serviced for the existing verified IP address-token pair reaching a threshold limit of API requests to service.

### Claim 17 (depends on 14)

The non-transitory computer readable storage medium of claim 14, further comprising computer program instructions configured to cause the processors of the proxy to:
maintain a time-to-live associated with the matching verified IP address-token pair; and
verify the token and the IP address associated with the API request in response to the IP address and the token combination matching the existing verified IP address-token pair if the time-to-live is not expired.

### Claim 18

A non-transitory computer readable storage medium storing computer program instructions configured for authenticating a client device to access an application programming interface (API) of a host device, the computer program instructions when executed by one or more processors of a proxy server device causing the processors of the proxy to:
inspect an API request received from the client device for a token associated with the API request and an internet protocol (IP) address associated with the client device;
in response to the API request including the token and the IP address, determine whether an existing verified IP address-token pair matches the IP address and the token combination associated with the API request;
verify the token based on attributes of the token in response to determining the existing verified IP address-token pair does not match the IP address and the token combination associated with the API request;
verify a timestamp attribute of the token is within a threshold period of time from a current time;
verify a truncated hash attribute of the token generated by the client device matches a truncated hash generated by the proxy from one or more of the attributes of the token, wherein the hash attribute is truncated based upon a character selection of the hash attribute to prevent a running of the hash through a hashing function in reverse in order to ascertain attributes of the token;
permit the API request in response to verification of the token associated with the API request;
store a new verified IP address-token pair comprising the IP address of the client device stored in association with the token; and
in response to storing the new verified IP address-token pair, transmitting the permitted API request to the host device for servicing.

### Claim 19 (depends on 18)

The non-transitory computer readable storage medium of claim 18, wherein verify the token based on attributes of the token further comprises:
generate, by the proxy, a first hash from one or more first attributes of the token;
compare the first hash to a second attribute of the token; and
verify the token if the first hash generated by the proxy matches the second attribute, where the second attribute is a second hash generated by the client device.

### Claim 20 (depends on 19)

The non-transitory computer readable storage medium of claim 19, wherein the verify of the token further comprises:
determine that the API request targets the host API;
retrieve a private encryption key associated with the host API; and
decrypt the token associated with the API request in response to retrieving the private encryption key associated with the host API targeted by the API request.

### Claim 21 (depends on 18)

The non-transitory computer readable storage medium of claim 18, further comprising computer program instructions configured to cause the processors of the proxy to:
in response to the IP address and the token combination associated with the API request lacking a match to the existing verified IP address-token pair, determine whether the existing verified IP address-token pair includes a matching token; and
verify the token based on the attributes of the token in response to determining the existing verified IP address-token pair does not include a matching token.