Technologies for token-based authentication and authorization of distributed computing resources

1. A method for token-based access authorization, the method comprising:

receiving a request for access to a server, the request including a digitally signed license token comprising an unencrypted payload portion and a digital signature comprising an encrypted hash value of the unencrypted payload;

decrypting the digital signature to obtain the previously-generated hash value;

generating a new hash value of the unencrypted payload portion;

determining whether the new hash value matches the previously-generated hash value;

upon determining that the new hash value matches the previously-generated hash value, generating a new digitally signed token;

transmitting the new digitally signed token to the server; and forwarding the request to the server for authorizing a remote computing device to access an API (Application Program Interface) as a function of the digitally signed license token.

2. The method of claim 1 , further comprising generating the digitally signed license token prior to receiving the request.

3. The method of claim 1 , wherein the unencrypted payload portion comprises a license identifier to uniquely identify the digitally signed license token, a unique key corresponding to an entity associated with the remote computing device, an expiration date to indicate a date on which the digitally signed license token expires, a key pair identifier to identify a cryptographic key pair used to generate the encrypted hash value of the unencrypted payload, a hash algorithm type to identify a hash algorithm used to generate the digital signature, an encryption algorithm type to identify an encryption algorithm used to generate the digital signature, and a token format version to indicate a version of the digitally signed license token.

4. The method of claim 3 , wherein the unique key is embedded as an extended attribute within the unencrypted payload portion.

5. The method of claim 3 , further comprising generating the digitally signed license token prior to receiving the request, wherein generating the digitally signed license token comprises:

generating the license identifier to uniquely identify the digitally signed license token;

identifying the unique key corresponding to the entity associated with the remote computing device;

determining the expiration date for the digitally signed license token;

embedding the license identifier, unique key, expiration date, the key pair identifier, the hash algorithm type, the encryption algorithm type, and the token format version into the unencrypted payload portion in cleartext; and

generating the digital signature appended to the digitally signed license token.

6. The method of claim 5 , wherein generating the digital signature appended to the digitally signed license token comprises:

hashing the unencrypted payload portion with a hashing algorithm to generate the previously-generated hash value, wherein the hashing algorithm corresponds to the hash algorithm type; and

encrypting the previously-generated hash value with the private key of the cryptographic key pair as a function of an encryption algorithm corresponding to the encryption algorithm type.

7. The method of claim 1 , wherein receiving the request comprises receiving a forwarded request from a management server or from an application of an Independent Software Vendor (ISV) executing on the remote computing device.

8. An access management server for token-based access authorization, the access management server comprising logic stored in memory, which when executed by a processor of the access management server, causes the access management server to:

receive a request for access to a server, the request including a digitally signed license token comprising an unencrypted payload portion and a digital signature comprising an encrypted hash value of the unencrypted payload;

decrypt the digital signature to obtain the previously-generated hash value;

generate a new hash value of the unencrypted payload portion;

determine whether the new hash value matches the previously-generated hash value;

upon determining that the new hash value matches the previously-generated hash value, generate a new digitally signed token;

transmit the new digitally signed token to the server; and

forward the request to the server for authorizing a remote computing device to access an API (Application Program Interface) as a function of the digitally signed license token.

9. The access management server of claim 8 , wherein the logic further causes the access management server to generate the digitally signed license token prior to receipt of the request.

10. The access management server of claim 8 , wherein the unencrypted payload portion comprises a license identifier to uniquely identify the digitally signed license token, a unique key corresponding to an entity associated with the remote computing device, an expiration date to indicate a date on which the digitally signed license token expires, a key pair identifier to identify a cryptographic key pair used to generate the encrypted hash value of the unencrypted payload, a hash algorithm type to identify a hash algorithm used to generate the digital signature, an encryption algorithm type to identify an encryption algorithm used to generate the digital signature, and a token format version to indicate a version of the digitally signed license token.

11. The access management server of claim 10 , wherein the unique key is embedded as an extended attribute within the unencrypted payload portion.

12. The access management server of claim 10 , wherein the logic further causes the access management to generate the digitally signed license token prior to receipt of the request, wherein generating the digitally signed license token comprises:

generate the license identifier to uniquely identify the digitally signed license token;

identify the unique key corresponding to the entity associated with the remote computing device;

determine the expiration date for the digitally signed license token;

embed the license identifier, unique key, expiration date, the key pair identifier, the hash algorithm type, the encryption algorithm type, and the token format version into the unencrypted payload portion in cleartext; and

generate the digital signature appended to the digitally signed license token.

13. The access management server of claim 12 , wherein generating the digital signature appended to the digitally signed license token comprises:

hash the unencrypted payload portion with a hashing algorithm to generate the previously-generated hash value, wherein the hashing algorithm corresponds to the hash algorithm type; and

encrypt the previously-generated hash value with the private key of the cryptographic key pair as a function of an encryption algorithm corresponding to the encryption algorithm type.

14. The access management server of claim 8 , wherein receiving the request comprises receiving a forwarded request from a management server or receiving the request message from an application of an Independent Software Vendor (ISV) executed on the remote computing device.

15. A system for token-based authentication and access authorization, the system comprising:

a remote computing device;

an access management server; and

a server;

wherein the access management server is configured to:

receive, from the remote computing device, a request requesting access to the server, the request including a digitally signed license token comprising an unencrypted payload portion and a first digital signature comprising an encrypted hash value of the unencrypted payload;

decrypt the first digital signature to obtain the previously-generated hash value;

generate a new hash value of the unencrypted payload portion;

determine whether the new hash value matches the previously-generated hash value;

upon determining that the new hash value matches the previously-generated hash value, generate a new digitally signed token, the new digitally signed token including a second digital signature appended thereto;

transmit the new digitally signed token to the server; and

forward the request to the server; and

wherein the server is configured to:

receive the new digitally signed token from the access management server;

verify the second digital signature appended to the new digitally signed token;

upon verifying the second digital signature, locally cache the new digitally signed token and associated entitlements;

receive the request forwarded by the access management server;

determine, as a function of the locally-cached new digitally signed token and associated entitlements, whether the access to the server requested by the remote computing device is authorized; and

upon determining that access to the server is authorized, grant the remote computing device access to the an API (Application Program Interface).

16. The system of claim 15 , wherein the access management server is further configured to generate the digitally signed license token prior to receipt of the request from the remote computing device.

17. The system of claim 15 , wherein the unencrypted payload portion of the digitally signed license token comprises a license identifier to uniquely identify the digitally signed license token, a unique key corresponding to an entity associated with the remote computing device, an expiration date to indicate a date on which the digitally signed license token expires, a key pair identifier to identify a cryptographic key pair used to generate the encrypted hash value of the unencrypted payload, a hash algorithm type to identify a hash algorithm used to generate the first digital signature, an encryption algorithm type to identify an encryption algorithm used to generate the first digital signature, and a token format version to indicate a version of the digitally signed license token.

18. The system of claim 17 , wherein the unique key is embedded as an extended attribute within the unencrypted payload portion.

19. The system of claim 17 , wherein the access management server is further configured to generate the digitally signed license token prior to receipt of the request from the remote computing device, wherein generating the digitally signed license token comprises:

generate the license identifier to uniquely identify the digitally signed license token;

identify the unique key corresponding to the entity associated with the remote computing device;

determine the expiration date for the digitally signed license token;

embed the license identifier, unique key, expiration date, the key pair identifier, the hash algorithm type, the encryption algorithm type, and the token format version into the unencrypted payload portion in cleartext; and

generate the first digital signature appended to the digitally signed license token.

20. The system of claim 19 , wherein generating the first digital signature appended to the digitally signed license token comprises:

hash the unencrypted payload portion with a hashing algorithm to generate the previously-generated hash value, wherein the hashing algorithm corresponds to the hash algorithm type; and

encrypt the previously-generated hash value with the private key of the cryptographic key pair as a function of an encryption algorithm corresponding to the encryption algorithm type.