Outer Rim Archives
Archives · 2021 · 20210377247

Application (pre-grant publication)

SYSTEM AND METHOD FOR PUBLIC API AUTHENTICATION

Number
20210377247
Published
2021-12-02
Filed
2020-05-29
Assignee
Disney Enterprises, Inc.
Inventors
Nigro; Carmen, Steinmann; Jonathan
CPC
H04L9/3239; H04L67/146; H04L9/3228; H04L9/0643; H04L63/0846; H04L63/083; H04L9/3236; H04L67/133; H04L63/1458; H04L9/0861
Verdict
Set aside API authentication, cybersecurity
Source
Google Patents · FreePatentsOnline

Abstract

A system and method for public API authentication by an API server includes receiving from a client/app a PK request for a Partial Key (PK), having a User ID, Session ID, rolling hash function (Fn2) version defining a client/app hash function (Fn2), and a received Temporary Key (TK); validating the received TK using Fn2 with the Session ID and either an Initial Key (IK) or a current PK; when the TK validation is complete, sending a PK calculated using a PK hash function (Fn1) with the User ID and a slot-generated rolling random number; receiving an API request for an API service having the User ID, Session ID, Fn2 version, and a received Authorization Key (AK); validating the received AK using Fn2 with the Session ID and the current PK; and when AK validation is complete, sending a successful response from the API service.

Background

BACKGROUND

APIs (Application Programming Interfaces) are fundamental to an organization's digital business. In order to transmit data between client and server within public digital products, such as websites, mobile applications and OTT (over-the-top) applications, and the like, the APIs that send the data to the client must remain accessible on the public internet. Any API on the public internet is vulnerable to security threats and requires preventive measures to reduce the risk profile.

For example, an unauthorized malicious client may write a script or create an App to make repeated API call or requests, which may overload the API server and produce “denial of service” API response messages, referred to a “Denial of Service” (DoS) attack. Also, an unauthorized malicious client may try to access unauthorized content or may send bad data to the server, which may slow down or corrupt the API server.

Given the high volume of API calls executed by an organization's digital products (e.g., billions of API calls per year), there is a need for an inexpensive and efficient way to authenticate traffic to ensure both security and data integrity in these high-volume scenarios. For example, for an API that is used to support a public user-facing software application, e.g., a mobile sports application, the API should only be accessed through the application. As a result, it is necessary to have a technique to validate that API calls and data are coming from approp

Claims

1. A method for providing public API authentication by an API server, comprising: receiving from a client a PK request for a partial key, the PK request having a User ID, a Session ID, a Client/App hash function (Fn2) version, and a received Temporary Key (TK), the Fn2 version defining a Client/App hash function (Fn2) used to create the TK; validating the received TK using the Fn2 hash function with the Session ID and one of an Initial Key (IK) and a current Partial Key (PK); when the validating the received TK is completed successfully, sending to the client a Partial Key (PK), the PK being calculated using a PK hash function (Fn1) with the User ID and a slot generated random key (Slot Gen Key), the Fn1 hash function being different from the Fn2 hash function; receiving from the client an API request for an API service, the API request having the User ID, the Session ID, Fn2 version, and a received Authorization Key (AK), the Fn2 version defining the Fn2 hash function used to create the AK; validating the received AK using the Fn2 hash function with the Session ID and the Partial Key (PK); and when the validating the received AK is completed successfully, sending to the client a successful response from the API service requested by the client. || 3. || 15. A method for providing public API authentication by a client, comprising: creating a random Session ID and a random User ID; obtaining a TK hash function (Fn2) version defining a TK hash function (Fn2); creating a Temporary Key (TK) using the TK Fn2 hash function with the Session ID and one of an Initial Key (IK) and a current Partial Key (PK); sending to an API server a PK request for a partial key, the PK request having the User ID, the Session ID, the TK Fn2 version, and the Temporary Key (TK), the TK Fn2 version defining the TK Fn2 hash function used to create the TK; receiving from the API server the current Partial Key (PK); obtaining an AK hash function (Fn2) version defining an AK Fn2 hash function, the AK Fn2 hash function being different from the TK Fn2 hash function; creating an Authentication Key (AK) using the AK Fn2 hash function with the Session ID and the current Partial Key (PK); sending to the API server an API request for an API service, the API request having the User ID, the Session ID, the AK Fn2 version, and the Authentication Key (AK), the AK Fn2 version defining the AK Fn2 hash function used to create the AK; and receiving from the API server a successful response for the requested API service. || 3. || 24. A method for providing public API authentication by an API server, comprising: receiving from a client a PK request for a partial key, the PK request having a User ID, a Session ID, a Client/App hash function (Fn2) version, and a received Temporary Key (TK), the Fn2 version defining a Client/App hash function (Fn2) used to create the TK; validating the received TK using the Fn2 hash function with the Session ID and one of an Initial Key (IK) and a current Partial Key (PK); when the validating the received TK is completed successfully, sending to the client a Partial Key (PK), the PK being calculated using a PK hash function (Fn1) with the User ID and a slot generated random key (Slot Gen Key); receiving from the client an API request for an API service, the API request having the User ID, the Session ID, Fn2 version, and a received Authorization Key (AK), the Fn2 version defining the Client/App hash function (Fn2) used to create the AK; re-creating the PK using the PK hash function (Fn1) with the User ID and the slot generated random key (Slot Gen Key), as a re-created PK; validating the received AK using the Fn2 hash function with the Session ID and the re-created PK; and when the validating the received AK is completed successfully, sending to the client a successful response from the API service requested by the client.