Access control using tokens and black lists

Patent metadata

Field	Value
Publication number	US-9537865-B1
Application number	US-201514957668-A
Country	US
Kind code	B1
Filing date	Dec 3, 2015
Priority date	Dec 3, 2015
Publication date	Jan 3, 2017
Grant date	Jan 3, 2017

Abstract

Examples of techniques for validating access tokens are described herein. An example computer-implemented method includes receiving, via a processor, a pushed event at a server. The method includes adding, via the processor, a value of the pushed event to a black list of recently disabled users, devices, applications, or any combination thereof. The method also includes receiving, via the processor, a request to access a resource on the server, the request including an access token. The method further includes comparing, via the processor, a field value of the access token with the black list. The method further includes declining, via the processor, the request based on a match of the field value of the access token with a value of the pushed event in the black list.

First claim

What is claimed is:

1. A method for access control, comprising:
determining whether an event has occurred, wherein the event is at least one of receiving an unauthorized request to access a resource, modification to the resource, exceeding a specified number of failed attempts to access the resource, a change in employment of a user attempting to access the resource, known illegality of the resource, and known vulnerability of the resource;
based on determining that the event has occurred, pushing the event to a server;
receiving the pushed event;
adding a value of the pushed event to a black list of recently disabled users, devices, applications, or any combination thereof;
receiving a request to access the resource on the server, the request comprising an access token;
comparing a field value of the access token with the black list; and
declining the request based on a match of the field value of the access token with a value of the pushed event in the black list.

2. The method of claim 1 , further comprising:
detecting an expiration time of a token associated with the pushed event; and
removing the pushed event from the black list at a predetermined time greater than the expiration time of the token associated with the pushed event.

3. The method of claim 1 , further comprising serving the request based on an absence of any field value of the access token in the black list.

4. The method of claim 1 , wherein receiving the pushed event comprises performing a long polling.

5. The method of claim 1 , wherein receiving the pushed event comprises receiving a message via message-oriented middleware.

6. The method of claim 1 , wherein receiving the pushed event comprises receiving a value of the pushed event via an open socket.

7. The method of claim 1 , further comprising invalidating the access token based on the match of the field value of the access token with the value of the pushed event in the black list.

8. A computer program product for access control, the computer program product comprising:
one or more computer-readable storage media and program instructions stored on the one or more computer-readable storage media, the program instructions comprising:
program instructions to determine whether an event has occurred, wherein the event is at least one of receiving an unauthorized request to access a resource, modification to the resource, exceeding a specified number of failed attempts to access the resource, a change in employment of a user attempting to access the resource, known illegality of the resource, and known vulnerability of the resource;
based on determining that the event has occurred, program instructions to push the event to a server;
program instructions to receive the pushed event;
program instructions to add a value from the pushed event to a black list of recently disabled users, devices, applications, or any combination thereof;
program instructions to receive a request to access the resource on the server, the request comprising an access token;
program instructions to compare a field value of the access token with the black list; and
program instructions to decline the request based on a match of the field value with a value of the pushed event in the black list.

9. The computer program product of claim 8 , further comprising:
program instructions to detect an expiration time of a token associated with the pushed event; and
program instructions to remove the pushed event from the black list at a predetermined time greater than the expiration time of the token associated with the pushed event.

10. The computer program product of claim 8 , further comprising program instructions to serve the request based on an absence of any field value of the access token in the black list.

11. The computer program product of claim 8 , wherein the program instructions to receive the pushed event comprises program instructions to perform a long polling.

12. The computer program product of claim 8 , wherein the program instructions to receive the pushed event comprises program instructions to receive a message via message-oriented middleware.

13. The computer program product of claim 8 , wherein the program instructions to receive the pushed event comprises program instructions to receive a value of the pushed event via an open socket.

14. The computer program product of claim 8 , further comprising program instructions to invalidate the access token based on the match of the field value of the access token with the value of the pushed event in the black list.

15. A computer system for access control, the computer system comprising:
one or more computer processors, one or more computer-readable storage media, and program instructions stored on the one or more computer-readable storage media for execution by at least one of the one or more processors, the program instructions comprising:
program instructions to determine whether an event has occurred, wherein the event is at least one of receiving an unauthorized request to access a resource, modification to the resource, exceeding a specified number of failed attempts to access the resource, a change in employment of a user attempting to access the resource, known illegality of the resource, and known vulnerability of the resource;
based on determining that the event has occurred, program instructions to push the event to a server;
program instructions to receive the pushed event;
program instructions to add a value from the pushed event to a black list of recently disabled users, devices, applications, or any combination thereof;
program instructions to receive a request to access the resource on the server, the request comprising an access token;
program instructions to compare a field value of the access token with the black list; and
program instructions to decline the request based on a match of the field value with a value of the pushed event in the black list.

16. The computer system of claim 15 , further comprising:
program instructions to detect an expiration time of a token associated with the pushed event; and
program instructions to remove the pushed event from the black list at a predetermined time greater than the expiration time of the token associated with the pushed event.

17. The computer system of claim 15 , further comprising program instructions to serve the request based on an absence of any field value of the access token in the black list.

18. The computer system of claim 15 , wherein the program instructions to receive the pushed event comprises program instructions to perform a long polling.

19. The computer system of claim 15 , wherein the program instructions to receive the pushed event comprises program instructions to receive a message via message-oriented middleware.

20. The computer system of claim 15 , wherein the program instructions to receive the pushed event comprises program instructions to receive a value of the pushed event via an open socket.

Assignees

• IBM

Inventors

• Borovoy Ishai
• Levin Iddo
• Schneider Haim
• Spector Artem
• Vilensky Tomer
• Zonens Uri

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title