Authentication and authorization of a privilege-constrained application

Patent metadata

Field	Value
Publication number	US-10992660-B2
Application number	US-201715793833-A
Country	US
Kind code	B2
Filing date	Oct 25, 2017
Priority date	Jun 24, 2015
Publication date	Apr 27, 2021
Grant date	Apr 27, 2021

Abstract

Methods and systems are provided for managing access to a client account related (CAR) resource. When a privilege-constrained (PC) application requests access to an individual client account, a single use authorization (SUA) code is created that is associated with the individual client account. The SUA code is routed to, and returned from, the privilege-constrained (PC) application to authenticate the PC application. The PC application, once authenticated, receives a permitted action token that identifies a limited set of privileges that the PC application is authorized to perform in connection with the CAR resource. The PC application provides the permitted action token to an access service. The access service limits access, by the PC application, to the CAR resource based on the permitted action token.

First claim

What is claimed is:

1. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to:
receive a request for a remote resource to perform an action of interest and a permitted action token from a privilege-constrained application, the permitted action token identifying a limited set of privileges that the privilege-constrained application is authorized to perform in connection with the remote resource, the permitted action token further associated with an application key embedded within the privilege-constrained application, the application key identifying the privilege-constrained application;
pass the request to the remote resource as a result of the action of interest falling within the limited set of privileges identified by the permitted action token; and
block the request as a result of the action of interest falling outside the limited set of privileges;
wherein the privilege-constrained application:
is to be loaded onto a client computing device with the limited set of privileges, the limited set of privileges comprising less than a full set of privileges that would be performable by the privilege-constrained application when unconstrained, the limited set of privileges placing restrictions on at least one of an operation performed in connection with the remote resource or data accessed in connection with the remote resource;
is authorized to cause performance of at least one permitted action in connection with a client account through the remote resource; and
lacks permission to cause performance of at least one blocked action in connection with the client account through the remote resource.

2. The non-transitory computer-readable storage medium of claim 1 , further comprising executable instructions that, as a result of execution by one or more processors, cause the computer system to establish a privilege-constrained session between the client computing device and the remote resource.

3. The non-transitory computer-readable storage medium of claim 1 , further comprising executable instructions that, as a result of execution by one or more processors, cause the computer system to review individual requests by the client computing device for access to the remote resource, and pass requests that correspond to the permitted action token to the remote resource.

4. The non-transitory computer-readable storage medium of claim 1 , further comprising executable instructions that, as a result of execution by one or more processors, cause the computer system to pass responses back to the client computing device when such responses correspond to the permitted action token.

5. A system, comprising:
at least one processor; and
a memory, coupled to the at least one processor, storing program instructions that, as a result of execution, cause the system to:
receive a request for a remote resource to perform an action of interest and a permitted action token from a privilege-constrained application, the permitted action token associated with an application key embedded within the privilege-constrained application that identifies the privilege-constrained application, the permitted action token identifying a limited set of privileges that the privilege-constrained application is authorized to perform in connection with the remote resource;
pass the request to the remote resource when the action of interest falls within the limited set of privileges identified by the permitted action token; and
block the request when the action of interest falls outside the limited set of privileges;
wherein the privilege-constrained application:
is to be loaded onto a client computing device with the limited set of privileges, wherein the limited privileges include less than a full set of privileges that would be performable by the privilege-constrained application when unconstrained, the limited set of privileges placing restrictions on at least one of an operation performed in connection with the remote resource or data accessed in connection with the remote resource;
is authorized to cause performance of at least one permitted action in connection with a client account through the remote resource; and
lacks permission to cause performance of at least one blocked action in connection with the client account through the remote resource.

6. The system of claim 5 , further comprising a data store, wherein the data store stores client account records that include a listing of accounts and remote resources to which the accounts correspond, the client account records including information identifying clients that have registered for a corresponding remote resource.

7. The system of claim 5 , further comprising instructions that, as a result of execution, cause the system to, when the request matches the permitted action token, establish a privilege-constrained session between the client computing device and the remote resource, wherein no further review of the permitted action token is required within the privilege-constrained session.

8. The system of claim 5 , further comprising instructions that, as a result of execution, cause the system to:
receive an initial request for privileged access to a client account from the privilege-constrained application, the initial request including a user identifier associated with the client account and an application key; and
in response to validation that the application key matches a stored application key associated with the privilege-constrained application and the user identifier, provide the permitted action token to the privilege-constrained application.

9. The system of claim 5 , further comprising instructions that, as a result of execution, cause the system to receive a second permitted action token from the privilege-constrained application that alters the limited set of privileges.

10. The system of claim 5 , wherein the permitted action token comprises a set of two or more permitted action tokens, wherein the limited set of privileges is defined collectively by the set of permitted action tokens.

11. The system of claim 5 , wherein the permitted action token is randomly generated in real time.

12. The system of claim 5 , further comprising instructions that, as a result of execution, cause the system to deny, by default, all actions except for permitted actions specifically identified by the permitted action token.

13. A computer implemented method, comprising:
receiving a request for access to a remote resource and a permitted action token from a privilege-constrained application, the permitted action token associated with an application-identifying application key embedded within the privilege-constrained application, the permitted action token identifying a limited set of privileges that the privilege-constrained application is authorized to perform in connection with the remote resource, the request further directing the remote resource to perform an action of interest;
accessing the remote resource in response to the request according to the limited set of privileges identified in the permitted access token;
passing the request to the remote resource when the action of interest falls within the limited set of privileges identified by the permitted action token; and
blocking the request when the action of interest falls outside the limited set of privileges;
wherein the limited set of privileges comprises less than a full set of privileges that would be performable by the privilege-constrained application when unconstrained, the limited set of privileges placing restriction

Assignees

• Amazon Tech Inc

Inventors

• Johansson Jesper Mikael
• Mcclintock Jon Arron

Classifications

• H04L47/70

  Admission control; Resource allocation · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04W12/069

  using certificates or pre-shared keys · CPC title

• H04L63/045

  wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14) · CPC title

• H04W12/068

  using credential vaults, e.g. password manager applications or one time password [OTP] applications · CPC title