Systems and methods for secure authentication
Systems, methods, and non-transitory computer-readable media can be configured to generate a first key for a first entity. A second key for a second entity can be generated wherein the first entity can authenticate the second entity based on an authentication token generated based on the second key. In some instances, the first entity can be a server and the second entity can be a client.
1. A computer-implemented method comprising:
generating, by a computing system, a first key for a first server entity associated with a first backend service of a social networking system; and
generating, by the computing system, a second key for a second entity, wherein the second entity is a client and the first backend service can authenticate the second entity and a request by the second entity based on an authentication token generated based on the second key, wherein the request by the second entity is provided to the backend service through an intermediary, and wherein the intermediary and the first backend service are controlled by a common entity.
2. The computer-implemented method of claim 1 , wherein the first key is generated based in part on an identity associated with the first server entity.
3. The computer-implemented method of claim 2 , wherein the second key is generated based in part on an identity associated with the second entity and the identity associated with the first server entity.
4. The computer-implemented method of claim 1 , wherein a derived second key, symmetric to the second key, can be generated based on the first key and an identity associated with the second entity.
5. The computer-implemented method of claim 1 , wherein the first key is generated based on applying a pseudorandom function to a root key and an identity associated with the first server entity.
6. The computer-implemented method of claim 1 , wherein the second key is generated based on applying a pseudorandom function to the first key and an identity associated with the second entity.
7. The computer-implemented method of claim 1 , wherein the authentication token comprises a message associated with the request and a message authentication code.
8. The computer-implemented method of claim 7 , wherein the message authentication code is generated based on the second key and the message.
9. The computer-implemented method of claim 7 , wherein the message authentication code is authenticated.
10. The computer-implemented method of claim 9 , wherein the message authentication code is authenticated based on a derived second key symmetric to the second key.
11. The computer-implemented method of claim 1 , wherein the intermediary includes a proxy or a frontend service associated with a social networking system.
12. A system comprising:
at least one processor; and
a memory storing instructions that, when executed by the at least one processor, cause the system to perform:
generating a first key for a first server entity associated with a first backend service of a social networking system; and
generating a second key for a second entity, wherein the second entity is a client and the first backend service can authenticate the second entity and a request by the second entity based on an authentication token generated based on the second key, wherein the request by the second entity is provided to the backend service through an intermediary, and wherein the intermediary and the first backend service are controlled by a common entity.
13. The system of claim 12 , wherein the first key is generated based in part on an identity associated with the first server entity.
14. The system of claim 13 , wherein the second key is generated based in part on an identity associated with the second entity and the identity associated with the first server entity.
15. The system of claim 12 , wherein a derived second key, symmetric to the second key, can be generated based on the first key and an identity associated with the second entity.
16. A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a computing system, cause the computing system to perform a method comprising:
generating a first key for a first server entity associated with a first backend service of a social networking system; and
generating a second key for a second entity, wherein the second entity is a client and the first backend service can authenticate the second entity and a request by the second entity based on an authentication token generated based on the second key, wherein the request by the second entity is provided to the backend service through an intermediary, and wherein the intermediary and the first backend service are controlled by a common entity.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the first key is generated based in part on an identity associated with the first server entity.
18. The non-transitory computer-readable storage medium of claim 17 , wherein the second key is generated based in part on an identity associated with the second entity and the identity associated with the first server entity.