Refresh token for credential renewal

Patent metadata

Field	Value
Publication number	US-10951618-B2
Application number	US-201916704985-A
Country	US
Kind code	B2
Filing date	Dec 5, 2019
Priority date	Dec 17, 2015
Publication date	Mar 16, 2021
Grant date	Mar 16, 2021

Abstract

Security credentials issued by an entity, such as an identity broker, can have a limited lifetime. Access to resources or content under those credentials then can only be obtained for a limited period of time, limiting the ability of an unauthorized entity obtaining the credentials to utilize those credentials for access. Along with the credentials, a refresh token can be issued to a requesting client that can enable the limited lifetime of the credentials to be renewed up to a maximum lifetime of the credentials and/or the token. A service providing access can determine that the client has a valid copy of the refresh token when the credentials are about to expire, and if so can cause the lifetime of the credentials to be extended another credential lifetime. This renewal can be done transparent to a user and without again contacting the identity broker.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
determining that a client is authorized to use one or more electronic resources for a user-configured amount of time that is associated with a credential, the user-configured amount of time based at least in part on a predetermined specific period of time for accessing the one or more electronic resources;
modifying, during the user-configured amount of time for the credential, a criteria to access the one or more electronic resources using the credential, based at least in part on a reevaluation of configuration information relating to the one or more electronic resources and a change in the configuration information;
determining, prior to an end of the user-configured amount of time, that the client possesses a valid refresh token associated with the credential;
performing a second determination, with respect to the modified criteria, that the client is still authorized to access the one or more electronic resources; and
extending the user-configured amount of time of the credential.

2. The computer-implemented method of claim 1 , further comprising:
determining that the one or more electronic resources is sufficient to perform a task requested by the client; and
allocating the one or more electronic resources for use by the client for the task within the user-configured amount of time.

3. The computer-implemented method of claim 1 , further comprising:
causing the credential to be renewed in response to a type of change being a first type of change corresponding to a set of permissible changes for the criteria to access the one or more electronic resources.

4. The computer-implemented method of claim 1 , further comprising:
determining that the user-configured amount of time of the credential will end within a time period after the extension of the user-configured amount of time;
receiving, from the client, proof of possession of the valid refresh token;
determining that the client is no longer authorized to access the one or more resources according to the modified criteria; and
causing access to the one or more electronic resources to be revoked at an end of the time period.

5. A system, comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the system to:
receive, from a client, an amount of time to be associated with a credential for access an electronic resource, the amount of time based at least in part on a predetermined specific period of time for accessing the electronic resource;
modify, during the amount of time, a criteria to access the electronic resource, based at least in part on a change in configuration of the electronic resource;
determine, prior to an end of the amount of time, that the client possesses a valid refresh token associated with the credential; and
extend the amount of time for the client to access the electronic resource based in part on a current authorization to access the electronic resource under the modified criteria.

6. The system of claim 5 , wherein the instructions that, when executed by the at least one processor, further cause the system to:
perform a first extension of the amount of time for the credential, based at least in part on extending the amount of time by an additional time associated with a lifetime period for the credential.

7. The system of claim 5 , wherein the instructions that, when executed by the at least one processor, further cause the system to:
verify the valid refresh token based in part on the valid refresh token comprising at least one of identification information, account information, and policy information.

8. The system of claim 5 , wherein the instructions that, when executed by the at least one processor, further cause the system to:
perform a second extension of the amount of time for the credential based in part on a new refresh token issued for the current authorization existing to access the electronic resource under the modified criteria.

9. The system of claim 5 , wherein the instructions that, when executed by the at least one processor, further cause the system to:
issue the refresh token with the credential for storage on the client.

10. The system of claim 5 , wherein the instructions that, when executed by the at least one processor, further cause the system to:
issue the refresh token separately from the credential;
enable the client to provide a second amount of time associated with a validity of the refresh token.

11. The system of claim 5 , wherein the instructions that, when executed by the at least one processor, further cause the system to:
perform a second determination that a difference between the criteria to access the electronic resource at a time of issuance of the credential and the modified criteria is within a set of permissible changes.

12. The system of claim 5 , wherein the instructions that, when executed by the at least one processor, further cause the system to:
enable the electronic resource to assume a role associated with the credential for performing a task.

13. The system of claim 5 , wherein the instructions that, when executed by the at least one processor, further cause the system to:
initiate a session for performing a task in response to the client being authorized to access the electronic resource; and
continue the session in response to determining that the client is still authorized under the modified criteria.

14. The system of claim 5 , wherein the instructions that, when executed by the at least one processor, further cause the system to:
determine that the amount of time of the credential will end within a time period after the extension of the amount of time for the client to access the electronic resource;
receive, from the client, proof of possession of the valid refresh token;
determine that the client is no longer authorized to access the electronic resource according to the modified criteria; and
cause access to the electronic resource to be revoked at an end of the time period.

15. The system of claim 5 , wherein the instructions that, when executed by the at least one processor, further cause the system to:
determine that the electronic resource is sufficient to perform a task requested by the client; and
allocate the electronic resource for use by the client for the task within the amount of time.

16. The system of claim 5 , wherein the instructions that, when executed by the at least one processor, further cause the system to:
cause the credential to be renewed in response to a type of change being a first type of change corresponding to a set of permissible changes for the criteria to access the electronic resource.

17. A non-transitory computer readable medium comprising instructions that when executed by at least one processor cause the at least one processor to:
receive, from a client, an amount of time to be associated with a credential for access an electronic resource, the amount of time based at least in part on a predetermined specific amount of time for accessing the electronic resource;
modify, during the amount of time, a criteria to access the electronic resource, based at least in part on a change in operating conditions for the electronic resource;
determine, prior to an end of the amount of time, that the client possesses a valid refresh token associated with the credential; and
extend the amount of time for the client to access the electronic resource based in part on a current authorization to access the electronic resource unde

Assignees

• Amazon Tech Inc

Inventors

• Baer Graeme David
• Frenkel Dmitry
• Barbour Marc R

Classifications

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/068 Primary

  using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088) · CPC title