Systems and methods for using an oauth client secret to encrypt data sent to browser

Patent metadata

Field	Value
Publication number	US-2019394032-A1
Application number	US-201916452032-A
Country	US
Kind code	A1
Filing date	Jun 25, 2019
Priority date	Jun 25, 2018
Publication date	Dec 26, 2019
Grant date	—

Abstract

Systems and methods for using an OAUTH client-secret to encrypt data sent to browser are disclosed. In one embodiment, in an issuer authorization services processing apparatus comprising at least one computer processor, a method for using an OAUTH client-secret to encrypt data may include: (1) receiving, from a client, a registration request; (2) returning, to the client, a client identifier, a client secret, and a nonce; (3) generating an extended client secret using a combination of the client identifier, the client secret, and the nonce; (4) storing the extended client secret; (5) receiving, from the client, encrypted plaintext data; (6) decrypting the encrypted plaintext data using the extended client secret; and (7) providing an encrypted response to the plaintext data, the encrypted response encrypted using the extended client secret.

First claim

What is claimed is:

1 . A method for using an OAUTH client-secret to encrypt data comprising:
in an information processing apparatus comprising at least one computer processor:
registering with a service provider for at least one service;
receiving, from the service provider, a client identifier, a client secret, and a nonce;
generating an extended client secret using a combination of the client identifier, the client secret, and the nonce; and
encrypting a plaintext communication to the service provider using the extended client secret.

2 . The method of claim 1 , wherein the registration with the service provider comprises a redirect URL, an application name, and a client name.

3 . The method of claim 1 , wherein the service provider generates the client identifier and the client secret.

4 . The method of claim 1 , wherein the client identifier is an OAUTH client identifier, and the client secret is an OAUTH client secret.

5 . The method of claim 1 , further comprising:
receiving an encrypted response to the plaintext communication from the service provider; and decrypting the encrypted response with the extended client secret.

6 . The method of claim 1 , further comprising:
expiring the extended client secret.

7 . The method of claim 1 , wherein the extended client secret is generated using the following algorithm:
SHA256Hash(Client-ID) XOR SHA256Hash(Client-Secret) XOR nonce.

8 . A method for using an OAUTH client-secret to encrypt data comprising:
in an issuer authorization services processing apparatus comprising at least one computer processor:
receiving, from a client, a registration request;
returning, to the client, a client identifier, a client secret, and a nonce;
generating an extended client secret using a combination of the client identifier, the client secret, and the nonce;
storing the extended client secret;
receiving, from the client, encrypted plaintext data;
decrypting the encrypted plaintext data using the extended client secret; and
providing an encrypted response to the plaintext data, the encrypted response encrypted using the extended client secret.

9 . The method of claim 8 , wherein the registration request comprises a redirect URL, an application name, and a client name.

10 . The method of claim 8 , wherein the client identifier is an OAUTH client identifier, and the client secret is an OAUTH client secret.

11 . The method of claim 8 , further comprising:
expiring the extended client secret.

12 . The method of claim 8 , wherein the extended client secret is generated using the following algorithm:
SHA256Hash(Client-ID) XOR SHA256Hash(Client-Secret) XOR nonce.

13 . The method of claim 8 , further comprising refreshing the nonce.

14 . A system for using an OAUTH client-secret to encrypt data comprising:
an issuer authorization services processing apparatus comprising at least one computer processor; an API gateway; and an API middleware system; wherein:
the API gateway receives, from a client a registration request;
the API gateway returns, to the client, a client identifier, a client secret, and a nonce;
the API gateway generates an extended client secret using a combination of the client identifier, the client secret, and the nonce;
the API gateway provides the extended client secret to an API middleware system;
the API middleware system stores the extended client secret;
the API gateway receives from the client, encrypted plaintext data;
the API gateway provides the encrypted plaintext data to the API middleware system;
the API middleware system decrypts the encrypted plaintext data using the extended client secret;
the API middleware system provides the API gateway with an encrypted response to the plaintext data, the encrypted response encrypted using the extended client secret; and
the API gateway provides the encrypted response to the client.

15 . The system of claim 14 , wherein the registration request comprises a redirect URL, an application name, and a client name.

16 . The system of claim 14 , wherein the client identifier is an OAUTH client identifier, and the client secret is an OAUTH client secret.

17 . The system of claim 14 , wherein the API gateway expires the extended client secret.

18 . The system of claim 14 , wherein the extended client secret is generated using the following algorithm:
SHA256Hash(Client-ID) XOR SHA256Hash(Client-Secret) XOR nonce.

19 . The system of claim 14 , wherein the API gateway refreshes the nonce.

Assignees

• Jpmorgan Chase Bank Na

Inventors

• Vudathu Raghuram
• Arora Anupam
• Sundar Gayathri

Classifications

• G06F9/54

  Interprogram communication · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04L9/0866 Primary

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title