Authorization token cache system and method

Patent metadata

Field	Value
Publication number	US-10097551-B2
Application number	US-201615078897-A
Country	US
Kind code	B2
Filing date	Mar 23, 2016
Priority date	May 30, 2014
Publication date	Oct 9, 2018
Grant date	Oct 9, 2018

Abstract

A system includes one or more processors to request access tokens from a token service computer, cache the access tokens and related information in a token cache, transmit the access tokens with a resource request to a resource server, and receive requested resources in response to the resource request. The resource server transmits representations of requested resources to computing devices having valid tokens. The access tokens and related information including credentials information and token metadata are stored in the token cache.

First claim

What is claimed is:

1. A method comprising:
receiving, by a token client from a user, credentials information for a token service;
storing, by the token client in a token cache, credentials information and token metadata;
wherein the token metadata stored by the token client in the token cache indicates how to request
an access token from the token service and how to retrieve an access
token from access token responses received from the token service;

receiving, by the token client from an application executing on one or more computing devices, a request to initialize a new session;
generating, by the token client, a session identifier that maps to a cache key for retrieving the token metadata and the credentials information from the token cache;
returning, by the token client to the application executing on one or more computing devices, the session identifier;
receiving, by the token client from the application executing on one or more computing devices, a request to access a protected resource from a resource server, wherein the request includes the session identifier;
responsive to receiving the request, mapping, by the token client, the session identifier to the cache key for retrieving the token metadata and the credentials information from the token cache;
retrieving, by the token client using the cache key, the token metadata and credentials information from the token cache, wherein the credentials information are not provided by the token client to the application executing on one or more computing devices;
responsive to retrieving the token metadata and credentials information from the token cache, generating, by the token client based at least in part on the token metadata, a token request that identifies the credentials information;
sending, by the token client to the token service, the token request that identifies the credentials information;
receiving, by the token client from the token service, an access token response and retrieving a first access token from the access token response using the token metadata;
storing, by the token client in the token cache and in association with the cache key, the first access token, such that the cache key may be used to retrieve the first access token;
sending, by the token client to a resource server, a resource request to access the protected resource;
wherein the resource request includes the first access token;
receiving, by the token client from the resource server, a resource response that includes a representation of the protected resource; and
returning, by the token client to the application executing on one or more computing devices, the representation of the protected resource.

2. The method of claim 1 , wherein generating, by the token client based at least in part on the token metadata, a token request that identifies the credentials information comprises:
determining, by the token client based at least in part on the token metadata, how to generate a token request to obtain the first access token from the token service based on a set of one or more service properties defined by the token metadata.

3. The method of claim 1 , further comprising:
receiving, by the token client, a change to the credentials information;
determining, by the token client, that the credentials information has changed;
in response to determining that the credentials information has changed:
sending, by the token client to the token service, a second token request that identifies the changed credentials information;
receiving a second access token response from the token service and retrieving a second access token from the second access token response using the token metadata; and
storing, by the token client in the token cache and in association with the cache key, the second access token.

4. The method of claim 1 , further comprising:
receiving, by the token client from the application executing on one or more computing devices, a particular request for the protected resource;
wherein the particular request includes the session identifier;
identifying, by the token client based on the session identifier, the cache key and retrieving the first access token from the token cache using the cache key,
wherein the resource request to access the protected resource is sent in response to retrieving the first access token from the token cache using the cache key.

5. The method of claim 1 , further comprising:
receiving, by the token client from the resource server in response to the resource request to access protected resources, a second access token;
storing, by the token client in the token cache and in association with the cache key, the second access token.

6. The method of claim 1 , further comprising:
sending, by the token client from the resource server, a second resource request that includes the first access token;
receiving, by the token client from the resource server, a second resource response indicating that the second resource request is one of an unauthorized request and a bad request;
in response to receiving the second resource response, generating, by the token client based at least in part on the token metadata, a second token request that identifies the credentials information;
sending, by the token client to the token service, the second token request that identifies the credentials information;
receiving a second access token response from the token service and retrieving a second access token from the second access token response using the token metadata; and
storing, by the token client in the token cache and in association with the cache key, the second access token.

7. The method of claim 1 , further comprising:
retrieving the first access token from a particular XPath expression within an extensible markup language (XML) document of the access token response, wherein the XPath expression is identified by the token metadata.

8. The method of claim 1 , further comprising:
retrieving the first access token from a particular JSONPath expression within a Javascript Object Notation (ISON) document of the access token response, wherein the JSONPath expression is identified by the token metadata.

9. The method of claim 1 , wherein sending, by the token client to a resource server, a resource request to access protected resources comprises:
determining, by the token client from the token metadata, a particular position in a body of the resource request;
binding the first access token to the particular position in the body of the resource request.

10. The method of claim 1 , further comprising:
executing a cryptographic hash function on the credentials information to obtain a first hash-based message authentication code;
receiving input comprising a particular username and a particular password;
in response to receiving the input, executing the cryptographic hash function on the particular username and the particular password to obtain a second hash-based message authentication code;
comparing the first hash-based message authentication code with the second hash-based message authentication code and determining whether the credentials information matches;
wherein the resource request to access protected resources is sent in response to determining that the credentials information matches.

11. One or more non-transitory computer-readable media storing one or more sequences of instructions, wherein the instructions include:
instructions, which when executed by one or more hardware processors, cause receiving, by a token client from a user, credentials information for a token service;
instructions, which when executed by one or more hardware processors, cause storing, by a

Assignees

• Oracle Int Corp

Inventors

• Chan Daniel
• Kunisetty Sunil

Classifications

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title