Secure device access token
A secure device access token allows a server to verify that a device presenting the token for access to the server is an authorized device and that an application presenting the token is an authorized application as it purports to be. The secure device access token is unique to the device and to the application attempting to access the server. The secure device access token differs from a bearer token in that it is unique to the device and to the application.
1. A method, comprising:
obtaining, from a cellular network service connection, a device identifier that identifies a device;
obtaining access by the device to a first network service provided by a wireless telecommunication carrier by way of the cellular network service connection using the device identifier to authenticate the device;
initiating a process to obtain, from an identity provider, a secure device access token in accordance with a request to the identity provider that includes at least the device identifier and an application authentication object that verifies that an application associated therewith is an authentic application issued to an identified user;
receiving the secure device access token from the identity provider in response to the request, wherein the secure device access token includes the application authentication object and the device identifier;
transferring from the first network service provided by the wireless telecommunication carrier over the cellular network service connection to a second network service provided by a first secure server over a Wi-Fi network service connection, including disconnecting the cellular network service connection and presenting the secure device access token to the first secure server over the Wi-Fi network service connection without further verification of the application or of the device; and
transferring from the second network service provided by the first secure server over the Wi-Fi network service connection to a third network service provided by a second secure server over a network service connection different from the cellular network service connection and from the Wi-Fi network service connection, including disconnecting from the Wi-Fi network service connection and presenting the secure device access token to the second secure server over the network service connection without further verification of the application or of the device.
2. The method as recited in claim 1 , wherein the application authentication object comprises an indication that the request is coming from a verified application.
3. The method as recited in claim 2 , wherein the application authentication object is a validation token obtained by a service with which the application is registered.
4. The method as recited in claim 1 , wherein a device corresponding to the device identifier comprises a cellular device, and wherein the device identifier comprises a unique identifier that verifies the request is coming from a verified cellular device.
5. The method as recited in claim 4 , wherein the device identifier further comprises at least a portion of one or more of the following: an International Mobile Equipment Identity, an International Mobile Subscriber Identity, or a Mobile Station International Subscriber Directory Number.
6. The method as recited in claim 4 , wherein the device identifier is obtained by way of the cellular network communication service.
7. The method as recited in claim 1 , wherein the application authentication object further comprises a token that verifies an instance of the application used to create the request.
8. The method as recited in claim 7 , wherein the application authentication object includes a null value.
9. The method as recited in claim 1 , further comprising:
obtaining the application authentication object;
wherein the obtaining an application authentication object and the request to the identity provider are accomplished with a single call.
10. The method as recited in claim 1 , wherein the obtaining a device identifier and the request to the identity provider are accomplished with a single call.
11. One or more non-transitory computer-readable storage media storing computer-executable instructions that, when executed, perform the following operations:
obtaining, from a cellular network service connection, a device identifier that identifies a device;
obtaining access by the device to a first network service provided by a wireless telecommunication carrier by way of the cellular network service connection using the device identifier to authenticate the device;
obtaining an application authentication object that verifies that an application associated therewith is an authentic application issued to an identified user;
providing the application authentication object to an identity provider;
providing the device identifier to the identity provider;
creating a request to the identity provider for a secure device access token, the request including at least the application authentication object and the device identifier;
transmitting the request to the identity provider;
receiving a secure device access token from the identity provider in response to the transmitted request,
transferring from the first network service provided by the wireless telecommunication carrier over the cellular network service connection to a second network service provided by a first secure server over a Wi-Fi network service connection, including disconnecting the cellular network service connection and presenting the secure device access token to the first secure server over the Wi-Fi network service connection without further verification of the application or of the device; and
transferring from the second network service provided by the first secure server over the Wi-Fi network service connection to a third network service provided by a second secure server over a network service connection different from the cellular network service connection and from the Wi-Fi network service connection, including disconnecting from the Wi-Fi network service connection and presenting the secure device access token to the second secure server over the network service connection without further verification of the application or of the device.
12. The one or more non-transitory computer-readable storage media as recited in claim 11 , wherein the obtaining an application authentication object and the providing the application authentication object are accomplished with a single call.
13. The one or more non-transitory computer-readable storage media as recited in claim 11 , wherein the secure device access token further comprises a JSON Web Token (JWT).
14. The one or more non-transitory computer-readable storage media as recited in claim 11 , further comprising additional computer-executable instructions that, when executed, perform an operation comprising signing the request with a unique private key.
15. The one or more non-transitory computer-readable storage media as recited in claim 11 , wherein the obtaining a device identifier further comprises obtaining a validation object from the wireless telecommunication carrier that validates a cellular device related to the request.
16. The one or more non-transitory computer-readable storage media as recited in claim 11 , wherein the obtaining an application authentication object further comprises calling an operating system identification service and receiving a data object that can be presented to authenticate an application used to create the request.
17. The one or more non-transitory computer-readable storage media as recited in claim 11 , wherein the application authentication object further comprises a token that verifies an instance of the application used to create the request.
18. The one or more non-transitory computer-readable storage media as recited in claim 17 , wherein the application authentication object includes a null value.
19. The one or more non-transitory computer-readable storage media as recited in claim 11 , wherein the obtaining a device identifier and the providing the device identifier are accomplished with a single call.