Systems and methods for providing and maintaining secure client-based permission lists

A system comprising at least one computer including a processor and a memory, wherein the at least one computer is configured to:

• receive, at a decoder library executing on the at least one computer, a public key from a public-private key pair and a salt value;
• generate, by the decoder library, a composite key using the public key from the public-private key pair, wherein generating the composite key includes providing a first output from a hashing function by hashing the public key as an input, wherein generating the composite key includes appending the salt value to the first output from the hashing function and providing the first output from the hashing function and the salt value appended to the first output from the hashing function to the hashing function as input, and receiving a second output from the hashing function, wherein the second output from the hashing function is converted into a byte array, and wherein the byte array is the composite key;
• receive, at the decoder library and from a client application, an encrypted entitlement token;
• decrypt, by the decoder library, the encrypted entitlement token using the composite key as a symmetric key, wherein decrypting the encrypted entitlement token generates a signed permission file, and wherein the signed permission file is in clear text;
• verify, using the public key, that the signed permission file was signed using a private key from the public-private key pair;
• determine, via a query of the signed permission file a permission indication for a service request;
• and
• send the permission indication to the client application.

A non-transitory computer readable storage medium, including instructions stored thereon, which instructions, when read and executed by one or more computer processors, cause the one or more computer processors to perform steps comprising:

• receiving, at a decoder library executing on a client device, a public key from a public-private key pair and a salt value;
• generating, by the decoder library, a composite key using the public key from the public-private key pair, wherein generating the composite key includes providing a first output from a hashing function by hashing the public key as an input, wherein generating the composite key includes appending the salt value to the first output from the hashing function and providing the first output from the hashing function and the salt value appended to the first output from the hashing function to the hashing function as input, and receiving a second output from the hashing function, wherein the second output from the hashing function is converted into a byte array, and wherein the byte array is the composite key;
• receiving, at the decoder library and from a client application, an encrypted entitlement token;
• decrypting, by the decoder library, the encrypted entitlement token using the composite key, wherein decrypting the encrypted entitlement token generates a signed permission file, and wherein the signed permission file is in clear text;
• verifying, using the public key, that the signed permission file was signed using a private key from the public-private key pair;
• determining, via a query of the signed permission file a permission indication for a service request;
• and
• sending the permission indication to the client application.