System, apparatus, method and program for preventing illegal distribution of an access token
AssigneeNEC Corporation
InventorsHikaru Tsuchida, Kengo Mori, Toshiyuki Isshiki
Life of this patent
Estimating the term…
Abstract
In IaaS (Infrastructure as a Service), when it is desirable to delegate the authority to a user outside a system, a recipient of an access token is designated, thereby preventing illegal distribution of the access token. There is provided an access token system including a generator and a verifier. The generator generates, using secret information of a recipient, a recipient-designated access token for which the recipient is designated, and provides the recipient-designated access token to a user. The verifier verifies that the user who makes access using the recipient-designated access token is the designated recipient.
Claims15
An access token system comprising:
- a generator that comprises,
- one or more first memories configured to store first instructions, and
- one or more first processors configured to execute the first instructions to:
- generate a first hash value based on a first access token;
- calculate an inverse element of a processed value, wherein the processed value is obtained by processing a random number and a secret information of a recipient using a processing function;
- generate a recipient-designated access token which includes a recipient-designated hash value, wherein the recipient-designated access token is generated by embedding the calculated inverse element of the processed value into the generated first hash value;
- and
- provide the recipient-designated access token to a user;
- and
- a verifier that comprises,
- one or more second memories configured to store second instructions, and
- one or more second processors configured to execute the second instructions to:
- receive, from the user of an input device, an input indicating the recipient-designated access token;
- and
- authenticate the recipient-designated hash value included in the recipient-designated access token;
- and
- in response to authenticating the recipient-designated hash value included in the recipient-designated access token, verify that the user who makes the input indicating the recipient-designated access token is a designated recipient to access a target resource.
An information processing apparatus comprising:
- one or more memories configured to store instructions;
- and
- one or more processors configured to execute the instructions to:
- generate a first hash value based on a first access token;
- calculate an inverse element of a processed value, wherein the processed value is obtained by processing a random number and a secret information of a recipient using a processing function;
- generate a recipient-designated access token which includes a recipient-designated hash value, wherein the recipient-designated access token is generated by embedding the calculated inverse element of the processed value into the generated first hash value;
- and
- provide the recipient-designated access token to a first user for access to a target resource.
An information processing apparatus comprising:
- one or more memories configured to store instructions;
- and
- one or more processors configured to execute the instructions to:
- receive an input indicating a recipient-designated access token including a recipient-designated hash value from an user, wherein the recipient-designated access token is being generated by:
- generating a first hash value based on a first access token;
- calculating an inverse element of a processed value, wherein the processed value is obtained by processing a random number and a secret information of a recipient using a processing function;
- and
- embedding the calculated inverse element of the processed value into the generated first hash value;
- authenticate the recipient-designated hash value included in the recipient-designated access token;
- and
- in response to authenticating the recipient-designated hash value included in the recipient-designated access token, verify that the user who inputs the recipient-designated access token is a designated recipient to access a target resource.
Dependencies are inferred from the claim text.