Apparatus and method for API authentication using two API tokens

1. An application programming interface (API) authentication method using two API tokens, the API authentication method comprising:

obtaining, at a user device, a general API token and information required for a one-time API token creation from a service providing apparatus, the general API token having an expiration time;

checking, at the user device, whether or not the general API token has expired, and

upon determining that the general API token has expired, obtaining a new general API token and new information required for the one-time API token creation from the service providing apparatus, and

upon determining that the general API token has not expired,

creating the one-time API token using the obtained information from the service providing apparatus, and

sending an API request to the service providing apparatus with both the general API token and the created one-time API token; and

in response to the API request from the user device, processing, at the service providing apparatus, the API request according to a result of authentication based on the general API token and the one-time API token, wherein

the processing of the API request comprises:

receiving the API request that contains the first one-time API token and the general API token from the user device,

identifying the user device with the general API token,

extracting information required for one-time API token creation which is to be mapped to the identified user device in mapping information,

generating a second one-time API token using the extracted information,

checking whether the first one-time API token is identical to the second one-time API token, and

processing the API request according to a result of the checking.

2. The API authentication method of claim 1 , wherein the obtaining of the general API token and the information required for a one-time API token creation comprises establishing a transport layer security (TLS)-based secure channel between the user device and the service providing apparatus to encrypt all transmitted data including the general API token and the information required for the one-time API token creation.

3. The API authentication method of claim 1 , wherein the information required for a one-time API token creation comprises a secret key, a cryptographic hash function, a reference timestamp, and a unit of counting.

4. The API authentication method of claim 3 , wherein the creating the first one-time token comprises

computing an integer time-counter using a current timestamp of a user device, the received reference timestamp and unit of counting; and

calculating the first one-time API token that is a hash value returned by applying the computed integer time-counter and the received secret key to the cryptographic hash function.

5. The API authentication method of claim 4 , wherein the API request further comprises a current timestamp used at the time of generating the first one-time API token.

6. The API authentication method of claim 1 , wherein the obtaining of the general API token and the information required for the one-time API token creation comprises

mapping, at the service providing apparatus, a user device name and details thereof about the general API token and one-time API token creation that have already been assigned to the user device, and

maintaining mapping information.

7. The API authentication method of claim 1 , wherein the processing of the API request comprises

checking the general API token received in the API request, and

refusing the API request upon determining that the received general API token has expired.

8. The API authentication method of claim 1 , wherein:

the API request further comprises a current timestamp used at the time of generating the first one-time API token, and

the generating of the second one-time API token comprises:

extracting the current timestamp from the API request,

computing an integer time-counter using the extracted current timestamp, a reference timestamp, and a unit of counting, the last two of which are contained in information required for the first one-time API token creation maintained in the service providing apparatus, and

calculating the second one-time API token that is a hash value returned by applying the computed integer time-counter and a secret key contained in the information required for the first one-time API token creation to a cryptographic hash function identified based on the information.