Credential-based application programming interface keys

Patent metadata

Field	Value
Publication number	US-9503442-B1
Application number	US-201414310330-A
Country	US
Kind code	B1
Filing date	Jun 20, 2014
Priority date	Jun 20, 2014
Publication date	Nov 22, 2016
Grant date	Nov 22, 2016

Abstract

A processing device comprises a processor coupled to a memory and is configured to obtain a credential associated with a particular access control interval, to determine an application programming interface (API) key based at least in part on the credential, and to utilize the API key in an API key enrollment protocol. The obtaining, determining and utilizing are repeated for one or more additional instances of the API key enrollment protocol corresponding to respective ones of one or more additional access control intervals. The processing device illustratively comprises a service requester device configured to carry out at least a portion of a given instance of the API key enrollment protocol with a service provider device. The API key may comprise, for example, the credential itself, or a function of the credential and other information. The credential may comprise, again by way of example, an intermediate value of a hash chain.

First claim

What is claimed is:

1. A method comprising:
obtaining a credential associated with a particular access control interval;
determining an application programming interface (API) key based at least in part on the credential, wherein the API key is used to control access to a protected resource over a network;
utilizing the API key in an API key enrollment protocol; and
repeating the obtaining, determining and utilizing for one or more additional instances of the API key enrollment protocol corresponding to respective ones of one or more additional access control intervals;
wherein the obtaining, determining, utilizing and repeating are performed by at least one processing device comprising a processor coupled to a memory.

2. The method of claim 1 wherein the API key comprises one of at least a portion of the credential itself and a function of at least a portion of the credential and other information.

3. The method of claim 1 wherein the credential comprises an intermediate value of a hash chain, and wherein obtaining the credential comprises:
determining an initial value of the hash chain;
hashing the initial value a designated number of times to obtain a final value of the hash chain;
associating intermediate values of the hash chain with respective ones of the access control intervals;
selecting as at least a portion of the credential the intermediate value associated with the particular access control interval; and
providing the final value of the hash chain to an authentication entity.

4. The method of claim 3 wherein the credential further comprises information sufficient to allow the authentication entity to identify the final value.

5. The method of claim 1 wherein utilizing the API key in an API key enrollment protocol comprises configuring an oauth_consumer_key field of a message of the API key enrollment protocol to incorporate the API key determined based at least in part on the credential associated with the particular access control interval.

6. The method of claim 1 wherein the API key comprises an intermediate value of a hash chain and an identifier utilizable to determine a final value of the hash chain.

7. The method of claim 1 wherein the credential comprises a one-time passcode generated by an authentication token.

8. The method of claim 1 wherein obtaining a credential comprises obtaining the credential from an API key service.

9. The method of claim 1 wherein the obtaining, determining, utilizing and repeating are performed by said at least one processing device executing program code of one or more software programs stored on a non-transitory processor-readable storage medium.

10. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
wherein said at least one processing device is configured:
to obtain a credential associated with a particular access control interval;
to determine an application programming interface (API) key based at least in part on the credential, wherein the API key is used to control access to a protected resource over a network:
to utilize the API key in an API key enrollment protocol; and
to repeat the obtaining, determining and utilizing for one or more additional instances of the API key enrollment protocol corresponding to respective ones of one or more additional access control intervals.

11. A method comprising:
receiving an application programming interface (API) key, wherein the API key is used to control access to a protected resource over a network;
determining from the API key a credential associated with a particular access control interval; and
authenticating the credential to control access to the protected resource in the particular access control interval;
wherein the receiving, determining and authenticating are performed by at least one processing device comprising a processor coupled to a memory.

12. The method of claim 11 wherein the credential comprises an intermediate value of a hash chain, and wherein authenticating the credential comprises:
identifying the particular access control interval;
determining a number of hash iterations associated with the particular access control interval;
applying the number of hash iterations to the intermediate value; and
if the applying yields a final value of the hash chain, accepting the credential as authentic.

13. The method of claim 11 wherein the receiving, determining and authenticating are performed by said at least one processing device executing program code of one or more software programs stored on a non-transitory processor-readable storage medium.

14. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
wherein said at least one processing device is configured:
to receive an application programming interface (API) key, wherein the API key is used to control access to a protected resource over a network;
to determine from the API key a credential associated with a particular access control interval; and
to authenticate the credential to control access to the protected resource in the particular access control interval.

15. A method comprising:
receiving a request for an application programming interface (API) key;
obtaining a credential;
generating the API key based at least in part on the credential, wherein the API key is used to control access to a protected resource over a network; and
providing the API key to at least one of a service requester and a service provider;
wherein the receiving, obtaining, generating and providing are performed by at least one processing device comprising a processor coupled to a memory.

16. The method of claim 15 wherein said at least one processing device is associated with an API key service.

17. The method of claim 16 wherein at least one of:
the request for the API key is received by the API key service from the service provider;
the API key is provided by the API key service to both the service requester and the service provider;
the API key is associated by the API key service with identification information of the service requester;
the identification information of the service requester comprises at least one of verification information and network address information of the service requester;
the network address information is maintained by the service provider and not by the API key service;
at least a portion of the identification information of the service requester is obtained by the service provider from the service requester in conjunction with registration of the service requester with the service provider; and
at least a portion of the identification information of the service requester is provided to the API key service by the service provider in conjunction with the request for the API key.

18. The method of claim 15 further comprising:
receiving a presented API key for validation in conjunction with a service request from the service requester;
generating a cryptographically-secured assertion for the presented API key based at least in part on identification information of the service requester; and
utilizing the assertion to validate the presented API key.

19. The method of claim 18 wherein utilizing the assertion to validate the presented API key comprises providing the assertion to the service provider in order to allow the service provider to validate the presented API key.

20. The method of claim 16 further comprising receiving identification information of the service reque

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Griffin Robert W
• Bailey Daniel V

Classifications

• H04L63/0838

  using one-time-passwords · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title