US 2020/0396223 A1 · CLIENT-SERVER SECURITY ENHANCEMENT USING INFORMATION ACCESSED FROM ACCESS TOKENS

Abstract

A service computing system receives an API call in which an authorization token, that contains an identifier in the content of the authorization token, is included in a header of the API call. The identifier is also included as a parameter passed in with the API call. The service computing system parses the API call to obtain the authorization token, and the identifier included in the authorization token. It also obtains the identifier passed in as a parameter of the API call. The service computing system compares the identifier obtained from the authorization token to the identifier passed in as a parameter of the API call to determine whether they match. If they do not match, the API call is processed as an unauthorized API call. A security system in the service computing system authorizes the API call based on the comparison.

Claims20

Dependent claims

A computing system, comprising:

a processor;
a front end system that exposes an application programming interface (API) that receives an access request requesting access to a protected resource, the access request having a header portion and a parameter portion;
and
a security system that identifies a resource access token in the header portion of the access request and authorizes the access request based on information in the resource access token and in the parameter portion of the resource access request.

1 more element

Dependencies are inferred from the claim text.

Facts

Application

16/443,236Filed 17 Jun 2019

Published

17 Dec 2020

Term ends

Not estimatedThe source records don’t support an estimate.

Classification6 codes

G06F 21/335
Using certificates: for accessing specific resources, e.g. using Kerberos tickets
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities
H04L 63/0807
For authentication of entities: using tickets, e.g. Kerberos

Client-server security enhancement using information accessed from access tokens

Life of this patent

Client-server security enhancement using information accessed from access tokens

Life of this patent

Abstract

Claims20