Apparatus and method for API authentication using two API tokens

• US 10,387,639 B2
• Filed: 12/08/2016
• Issued: 08/20/2019
• Est. Priority Date: 12/08/2015
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Jeon, Hong Seok, Lee, Bhum Cheol
• Primary Examiner(s): Turchen, James R
• Application Number:
  US15/373,376
• Publication Number:
  US 20170161486A1
• Time in Patent Office: 985 Days
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 2463/121 Timestamp
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

An application programming interface (API) authentication method using two API tokens which includes issuing a general API token and providing information required for a one-time API token to a user device; and in response to an API request from the user device, processing an API request according to a result of authentication based on the general API token and a one-time API token, which is generated using the information required for a one-time API token creation.

Claims

1. An application programming interface (API) authentication method using two API tokens, the API authentication method comprising:

obtaining, at a user device, a general API token and information required for a one-time API token creation from a service providing apparatus, the general API token having an expiration time;

checking, at the user device, whether or not the general API token has expired, and

upon determining that the general API token has expired, obtaining a new general API token and new information required for the one-time API token creation from the service providing apparatus, and

upon determining that the general API token has not expired,

creating the one-time API token using the obtained information from the service providing apparatus, and

sending an API request to the service providing apparatus with both the general API token and the created one-time API token; and

in response to the API request from the user device, processing, at the service providing apparatus, the API request according to a result of authentication based on the general API token and the one-time API token, wherein

the processing of the API request comprises;

receiving the API request that contains the first one-time API token and the general API token from the user device,

identifying the user device with the general API token,

extracting information required for one-time API token creation which is to be mapped to the identified user device in mapping information,

generating a second one-time API token using the extracted information,

checking whether the first one-time API token is identical to the second one-time API token, and

processing the API request according to a result of the checking.

2. The API authentication method of claim 1, wherein the obtaining of the general API token and the information required for a one-time API token creation comprises establishing a transport layer security (TLS)-based secure channel between the user device and the service providing apparatus to encrypt all transmitted data including the general API token and the information required for the one-time API token creation.

3. The API authentication method of claim 1, wherein the information required for a one-time API token creation comprises a secret key, a cryptographic hash function, a reference timestamp, and a unit of counting.

4. The API authentication method of claim 3, wherein the creating the first one-time token comprises

computing an integer time-counter using a current timestamp of a user device, the received reference timestamp and unit of counting;

and

calculating the first one-time API token that is a hash value returned by applying the computed integer time-counter and the received secret key to the cryptographic hash function.

5. The API authentication method of claim 4, wherein the API request further comprises a current timestamp used at the time of generating the first one-time API token.

6. The API authentication method of claim 1, wherein the obtaining of the general API token and the information required for the one-time API token creation comprises

mapping, at the service providing apparatus, a user device name and details thereof about the general API token and one-time API token creation that have already been assigned to the user device, and

maintaining mapping information.

7. The API authentication method of claim 1, wherein the processing of the API request comprises

checking the general API token received in the API request, and

refusing the API request upon determining that the received general API token has expired.

8. The API authentication method of claim 1, wherein:

the API request further comprises a current timestamp used at the time of generating the first one-time API token, and

the generating of the second one-time API token comprises;

extracting the current timestamp from the API request,

computing an integer time-counter using the extracted current timestamp, a reference timestamp, and a unit of counting, the last two of which are contained in information required for the first one-time API token creation maintained in the service providing apparatus, and

calculating the second one-time API token that is a hash value returned by applying the computed integer time-counter and a secret key contained in the information required for the first one-time API token creation to a cryptographic hash function identified based on the information.