Access control using tokens and black lists

• US 9,537,865 B1
• Filed: 12/03/2015
• Issued: 01/03/2017
• Est. Priority Date: 12/03/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Borovoy, Ishai, Vilensky, Tomer, Zonens, Uri, Levin, Iddo, Schneider, Haim, Spector, Artem
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US14/957,668
• Time in Patent Office: 397 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

Examples of techniques for validating access tokens are described herein. An example computer-implemented method includes receiving, via a processor, a pushed event at a server. The method includes adding, via the processor, a value of the pushed event to a black list of recently disabled users, devices, applications, or any combination thereof. The method also includes receiving, via the processor, a request to access a resource on the server, the request including an access token. The method further includes comparing, via the processor, a field value of the access token with the black list. The method further includes declining, via the processor, the request based on a match of the field value of the access token with a value of the pushed event in the black list.

Claims

1. A method for access control, comprising:

determining whether an event has occurred, wherein the event is at least one of receiving an unauthorized request to access a resource, modification to the resource, exceeding a specified number of failed attempts to access the resource, a change in employment of a user attempting to access the resource, known illegality of the resource, and known vulnerability of the resource;

based on determining that the event has occurred, pushing the event to a server;

receiving the pushed event;

adding a value of the pushed event to a black list of recently disabled users, devices, applications, or any combination thereof;

receiving a request to access the resource on the server, the request comprising an access token;

comparing a field value of the access token with the black list; and

declining the request based on a match of the field value of the access token with a value of the pushed event in the black list.

2. The method of claim 1, further comprising:

detecting an expiration time of a token associated with the pushed event; and

removing the pushed event from the black list at a predetermined time greater than the expiration time of the token associated with the pushed event.

3. The method of claim 1, further comprising serving the request based on an absence of any field value of the access token in the black list.

4. The method of claim 1, wherein receiving the pushed event comprises performing a long polling.

5. The method of claim 1, wherein receiving the pushed event comprises receiving a message via message-oriented middleware.

6. The method of claim 1, wherein receiving the pushed event comprises receiving a value of the pushed event via an open socket.

7. The method of claim 1, further comprising invalidating the access token based on the match of the field value of the access token with the value of the pushed event in the black list.

8. A computer program product for access control, the computer program product comprising:

one or more computer-readable storage media and program instructions stored on the one or more computer-readable storage media, the program instructions comprising;

program instructions to determine whether an event has occurred, wherein the event is at least one of receiving an unauthorized request to access a resource, modification to the resource, exceeding a specified number of failed attempts to access the resource, a change in employment of a user attempting to access the resource, known illegality of the resource, and known vulnerability of the resource;

based on determining that the event has occurred, program instructions to push the event to a server;

program instructions to receive the pushed event;

program instructions to add a value from the pushed event to a black list of recently disabled users, devices, applications, or any combination thereof;

program instructions to receive a request to access the resource on the server, the request comprising an access token;

program instructions to compare a field value of the access token with the black list; and

program instructions to decline the request based on a match of the field value with a value of the pushed event in the black list.

9. The computer program product of claim 8, further comprising:

program instructions to detect an expiration time of a token associated with the pushed event; and

program instructions to remove the pushed event from the black list at a predetermined time greater than the expiration time of the token associated with the pushed event.

10. The computer program product of claim 8, further comprising program instructions to serve the request based on an absence of any field value of the access token in the black list.

11. The computer program product of claim 8, wherein the program instructions to receive the pushed event comprises program instructions to perform a long polling.

12. The computer program product of claim 8, wherein the program instructions to receive the pushed event comprises program instructions to receive a message via message-oriented middleware.

13. The computer program product of claim 8, wherein the program instructions to receive the pushed event comprises program instructions to receive a value of the pushed event via an open socket.

14. The computer program product of claim 8, further comprising program instructions to invalidate the access token based on the match of the field value of the access token with the value of the pushed event in the black list.

15. A computer system for access control, the computer system comprising:

one or more computer processors, one or more computer-readable storage media, and program instructions stored on the one or more computer-readable storage media for execution by at least one of the one or more processors, the program instructions comprising;

program instructions to determine whether an event has occurred, wherein the event is at least one of receiving an unauthorized request to access a resource, modification to the resource, exceeding a specified number of failed attempts to access the resource, a change in employment of a user attempting to access the resource, known illegality of the resource, and known vulnerability of the resource;

based on determining that the event has occurred, program instructions to push the event to a server;

program instructions to receive the pushed event;

program instructions to add a value from the pushed event to a black list of recently disabled users, devices, applications, or any combination thereof;

program instructions to receive a request to access the resource on the server, the request comprising an access token;

program instructions to compare a field value of the access token with the black list; and

program instructions to decline the request based on a match of the field value with a value of the pushed event in the black list.

16. The computer system of claim 15, further comprising:

program instructions to detect an expiration time of a token associated with the pushed event; and

program instructions to remove the pushed event from the black list at a predetermined time greater than the expiration time of the token associated with the pushed event.

17. The computer system of claim 15, further comprising program instructions to serve the request based on an absence of any field value of the access token in the black list.

18. The computer system of claim 15, wherein the program instructions to receive the pushed event comprises program instructions to perform a long polling.

19. The computer system of claim 15, wherein the program instructions to receive the pushed event comprises program instructions to receive a message via message-oriented middleware.

20. The computer system of claim 15, wherein the program instructions to receive the pushed event comprises program instructions to receive a value of the pushed event via an open socket.