# US 2021/0344512 A1 · Methods and systems for pki-based authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344512 A1 - Document ID: US20210344512A1 - Status: Published application - Kind: A1 - Application number: 17/373,037 - Filed: 2021-07-12 - Published: 2021-11-04 - Earliest claimed: 2015-11-13 - Assignees: Visa International Service Association - Applicants: Visa International Service Association - Inventors: Minghua Xu; Jose Rios Trevino; Ying Hao - Web page: https://patentgrep.com/patent/US20210344512A1 ## CPC - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3247: {involving digital signatures} - H04L 9/3249: {using RSA or related signature schemes, e.g. Rabin scheme} - H04L 9/3252: {using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/105: {Multiple levels of security} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 63/168: {above the transport layer} - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - H04L 2209/76: Proxy, i.e. using intermediary entity to perform cryptographic operations - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and devices are provided for authenticating API messages using PKI-based authentication techniques. A client system can generate a private/public key pair associated with the client system and sign an API message using the private key of the private/public key pair and a PKI-based cryptographic algorithm, before sending the signed API message to a server system. The server system (e.g., operated by a service provider) can authenticate the incoming signed API message using a proxy authenticator located in less trusted zone (e.g., a perimeter network) of the server system. In particular, the proxy authenticator can be configured to verify the signature of the signed API message using the public key corresponding to the private key and the same cryptographic algorithm. The authenticated API message can then be forwarded to a more trusted zone (e.g., an internal network) of the server system for further processing. ## Claims ### Claim 1 A computer-implemented method comprising: obtaining, by a first computer in a high security zone of a first system, a first application programming interface (API) message, wherein the first API message is a request for a service provided by a second system, the first system comprises the high security zone of the first system behind a first firewall and a low security zone of the first system in front of the first firewall, and the second system comprises a high security zone of the second system behind a second firewall and a low security zone of the second system in front of the second firewall; obtaining, by the first computer, data to be signed from the first API message, the data comprising a resource identifier corresponding to the service; generating, by the first computer, a signature token by signing the data using a cryptographic algorithm and a private key associated with the first system, the generating comprising applying a hash function of the cryptographic algorithm to the data from the first API message, including the resource identifier, to obtain at least a portion of the signature token; and transmitting the first API message to a second computer in the low security zone of the second system, wherein the first API message invokes the service provided by the second system in a third computer of the high security zone of the second system. ### Claim 2 (depends on 1) The method of claim 1, wherein the cryptographic algorithm comprises RSA-SHA2 or elliptic curve digital signature algorithm (ECDSA). ### Claim 3 (depends on 1) The method of claim 1 further comprising: transmitting, over a network, a public key corresponding to the private key associated with the first system; and receiving, over the network, a key ID that identifies the public key, wherein the obtained first API message includes the key ID. ### Claim 4 (depends on 3) The method of claim 3, wherein the public key is transmitted over the network to another computer from which the second computer retrieves the public key. ### Claim 5 (depends on 3) The method of claim 3, wherein the key ID is received from the second system and is configured to be used by the second computer to retrieve the public key for authenticating the first API message. ### Claim 6 (depends on 1) The method of claim 1, wherein the first API message is a response to an API request for a service provided by the first system, and wherein the API request is received by the first computer via another computer in the low security zone of the first system. ### Claim 7 (depends on 1) The method of claim 1, where the signed data includes only a portion of a header and/or body of the first API message. ### Claim 8 (depends on 1) The method of claim 1, wherein the second computer in the low security zone of the second system is configured to route the first API message to the third computer in the high security zone of the second system that implements the service provided by the second system. ### Claim 9 (depends on 1) The method of claim 1, further comprising: encrypting at least a portion of the first API message using a shared secret that is shared with a third computer of the high security zone of the second system. ### Claim 10 (depends on 1) The method of claim 1, wherein the second computer is configured to route a decrypted first API message to the third computer. ### Claim 11 A first system, comprising: a first computer in a low security zone of the first system, the first computer comprising one or more processors configured to: receive a first application programming interface (API) message from a second system, the first API message comprising a request for a service provided by the first system, the first system comprising a high security zone of the first system behind a first firewall and the low security zone of the first system in front of the first firewall, the second system comprising a high security zone of the second system behind a second firewall and a low security zone of the second system in front of the second firewall, the first API message generated by a second computer in the high security zone of the second system using a cryptographic algorithm and a private key associated with the second system, the first API message comprising a resource identifier corresponding to the service provided by the first system; authenticate the first API message by obtaining a signature token from the first API message and verifying the signature token using a hash function of the cryptographic algorithm and a public key that corresponds to the private key associated with the second system; and transmit the authenticated first API message to a third computer in the high security zone of the first system to invoke the service. ### Claim 12 (depends on 11) The first system of claim 11, wherein the cryptographic algorithm comprises RSA-SHA2 or elliptic curve digital signature algorithm (ECDSA). ### Claim 13 (depends on 11) The first system of claim 11, wherein the first API message comprises a key identifier associated with the public key, and wherein authenticating the first API message comprises retrieving the public key using the key identifier. ### Claim 14 (depends on 11) The first system of claim 11, wherein authenticating the first API message comprises: generating data to sign based on the first API message; applying the hash function to the data to sign to obtain a hash; applying a decryption function to at least a portion of the signature token and the public key to obtain decrypted signature data; and determining whether the hash matches the decrypted signature data. ### Claim 15 (depends on 14) The first system of claim 14, wherein the first API message comprises a method, a message header, and a message body, and wherein generating the data to sign based on the first API message comprises: obtaining a timestamp from the signature token; obtaining a header hash of at least a portion of the message header; obtaining a body hash of at least a portion of the message body; and combining the timestamp, the header hash, the body hash, the method and the resource identifier to generate the data to sign. ### Claim 16 (depends on 11) The first system of claim 11, wherein authenticating the first API message comprises verifying a timestamp associated with the first API message to ensure that the first API message is received within a predetermined threshold amount of time from a time indicated by the timestamp. ### Claim 17 (depends on 11) The first system of claim 11, wherein the first API message comprises a key identifier and authenticating the first API message comprises: retrieving one or more allowable network addresses using the key identifier; and verifying that a network address associated with the first API message is included in the one or more allowable network addresses. ### Claim 18 (depends on 11) The first system of claim 11, wherein the third computer in the high security zone of the first system is configured to decrypt at least a portion of the authenticated first API message using a shared secret to obtain decrypted message data and to validate the decrypted message data. ### Claim 19 (depends on 18) The first system of claim 18, wherein the third computer in the high security zone of the first system is further configured to route the authenticated first API message to a fourth computer in the high security zone of the first system that implements the service provided by the first system. ### Claim 20 (depends on 19) The first system of claim 19, wherein the one or more processors are further configured to cause generating, by a fifth computer in the high security zone of the first system, a second API message that corresponds to the first API message, using the cryptographic algorithm and the private key associated with the first system, wherein the second API message is authenticated by a sixth computer in the low security zone of the second system using a public key that corresponds to the private key associated with the first system.