Method and apparatus for authenticating access by a service
View Patent ↗An approach is presented for authenticating access by a service. The server receives a request, from a service, for the server, wherein the request includes, at least in part, a service-specific secret or a derivation of the service-specific secret. Further, the server determines to generate a server-computed secret. Then, the server determines to authenticate the request based, at least in part, on a comparison of the service-specific secret or the derivation of the service-specific secret against the server-computed secret or a derivation of the server-computed secret. The service receives credentials from a credential manager. The secret is part of the credentials. The credential manager and the server share some secret pre-configured data like key tables. The generation of the service specific secrets is based on the shared data.
1. A method comprising:
receiving a request from a service for a server, wherein the request includes, at least in part, a service-specific secret or a derivation of the service-specific secret based, at least in part, on a service level and a key table;
determining to generate a server-computed secret based, at least in part, on the key table; and
determining to authenticate the request based, at least in part, on a comparison of the service-specific secret or the derivation of the service-specific secret against the server-computed secret or a derivation of the server-computed secret.
2. A method of claim 1 , wherein the service-specific secret is pre-generated and provided to the service for the authentication to the server.
3. A method of claim 1 , wherein the service-specific secret and the server-computed secret are generated based, at least in part, on independent instances of a secret generator.
4. A method of claim 1 , wherein one or more parameters are pre-configured, and wherein the service-specific secret and the server-computed secret are generated based, at least in part, on the one or more parameters.
5. A method of claim 4 , wherein one or more other parameters are determined based, at least in part, on the one or more parameters, the one or more other parameters determined via the service, the server, a credential manager, or a combination thereof, and
wherein the service-specific secret, the server-computed secret, or a combination thereof is further based, at least in part, on the one or more other parameters.
6. A method of claim 5 , wherein the one or more other parameters are determined from a source common to the credential manager and the server.
7. A method of claim 5 , wherein the one or more parameters, the one or more other parameters, or a combination thereof includes, at least in part, a service identifier, one or more keys, auxiliary data, or a combination thereof
8. A method of claim 1 , further comprising:
determining to cache the server-computed secret at the server,
wherein the determining to authenticate the request is based, at least in part, on the cached server-computed secret.
9. An apparatus comprising:
at least one processor; and
at least one memory including computer program code for one or more programs,
the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following,
receive a request from a service for a server, wherein the request includes, at least in part, a service-specific secret or a derivation of the service-specific secret based, at least in part, on a service level and a key table;
determine to generate a server-computed secret based, at least in part, on the key table; and
determine to authenticate the request based, at least in part, on a comparison of the service-specific secret or the derivation of the service-specific secret against the server-computed secret or a derivation of the server-computed secret.
10. An apparatus of claim 9 , wherein the service-specific secret is pre-generated and provided to the service for the authentication to the server.
11. An apparatus of claim 9 , wherein the service-specific secret and the server-computed secret are generated based, at least in part, on independent instances of a secret generator.
12. An apparatus of claim 9 , wherein one or more parameters are pre-configured, and,
wherein the service-specific secret and the server-computed secret are generated based, at least in part, on the one or more parameters.
13. An apparatus of claim 12 , wherein one or more other parameters are determined based, at least in part, on the one or more parameters, the one or more other parameters determined via the service, the server, the credential manager, or a combination thereof, and
wherein the service-specific secret, the server-computed secret, or a combination thereof is further based, at least in part, on the one or more other parameters.
14. An apparatus of claim 13 , wherein the one or more other parameters are determined from a source common to the credential manager and the server.
15. An apparatus of claim 13 , wherein the one or more parameters, the one or more other parameters, or a combination thereof includes, at least in part, a service identifier, one or more keys, auxiliary data, or a combination thereof
16. An apparatus of claim 9 , wherein the apparatus is further caused to:
determine to cache the server-computed secret at the server,
wherein the determination to authenticate the request is based, at least in part, on the cached server-computed secret.
17. A method comprising facilitating access to at least one interface configured to allow access to at least one service, the at least one service configured to perform at least the following:
receiving a request from a service for a server, wherein the request includes, at least in part, a service-specific secret or a derivation of the service-specific secret based, at least in part, on a service level and a key table;
determining to generate a server-computed secret based, at least in part, on the key table; and
determining to authenticate the request based, at least in part, on a comparison of the service-specific secret or the derivation of the service-specific secret against the server-computed secret or a derivation of the server-computed secret.
18. A method of claim 17 , wherein the service-specific secret and the server-computed secret are generated based, at least in part, on independent instances of a secret generator.
19. A method of claim 17 , wherein one or more parameters are pre-configured, and
wherein the service-specific secret and the server-computed secret are generated based, at least in part, on the one or more parameters.
20. A method of claim 17 , wherein one or more other parameters are determined based, at least in part, on the one or more parameters, the one or more other parameters determined via the service, the server, the credential manager, or a combination thereof, and
wherein the service-specific secret, the server-computed secret, or a combination thereof is further based, at least in part, on the one or more other parameters.