Client-side authentication system and associated method
A client-side, bearer token-based decentralized authentication system and associated method are, from a user's perspective, similar to familiar, centralized third-party authentication techniques.
1. A client computing device of a decentralized network comprising:
a network interface configured to couple the client computing device to a storage server;
a display;
a hardware processor;
a non-transitory computer readable storage medium storing program instructions for execution by the hardware processor in order to cause the client computing device to
execute a first session of a decentralized application and a second session of an authenticator application distinct from the first session, the authenticator application having access to a top-level private key specific to a user and the decentralized application having no access to the top-level private key;
display in a first user interface a login option for the first session of the decentralized application;
in response to a user selection to login from the login option, transmit via a first uniform resource locator (URL) query string from the first session of the decentralized application, an access token to the second session of the authenticator application, the access token authorizing the decentralized application to read data from the storage server on behalf of the user;
receive via a second URL query string from the authenticator application a response token and an encrypted application-specific private key derived from the top-level private key and an identifier specific to the decentralized application;
transmit the response token to the storage server with the application-specific private key, the application-specific private key providing access to a storage location on the storage server that is configured to store data that is specific to the user and the decentralized application;
receive the data from the storage server.
2. The client computing device of claim 1 , wherein the first user interface is configured to display data-access permissions requested by the decentralized application.
3. The client computing device of claim 2 , wherein the response token comprises fields reflecting the data-access permissions requested by the decentralized application.
4. The client computing device of claim 1 , wherein the second session of the authenticator application is a browser comprising navigation icons and a display area configured to display graphics and human-readable content.
5. The client computing device of claim 4 , wherein the browser is a locally stored executable application.
6. The client computing device of claim 4 , wherein the browser is a web-based application.
7. The client computing device of claim 1 , wherein the access token is a JSON web token.
8. The client computing device of claim 1 , wherein a user selection of the login option initiates a method call that sends the access token to the authenticator application.
9. The client computing device of claim 1 , wherein the non-transitory computer readable storage medium further stores program instructions for execution by the hardware processor in order to cause the client computing device to
with the decentralized application, generate and store a transit key for the session of the decentralized application; and
pass a public portion of the transit key in a field of the access token,
wherein the received encrypted application-specific private key is encrypted with the public portion of the transit key.
10. A method of authenticating a user with a client computing device of a decentralized network, the method comprising:
under the control of a client computing device configured to communicate with a storage server via a network interface and to execute a decentralized application and an authenticator application distinct from the decentralized application, the authenticator application having access to a top-level private key specific to a user and the decentralized application having no access to the top-level private key,
receiving a user selection to login from the decentralized application;
in response to the user selection, transmitting an access token from the decentralized application to the authenticator application via a first uniform resource locator (URL) query string, the access token authorizing the decentralized application to read or write data to/from the storage server on behalf of the user;
receiving via a second URL query string from the authenticator application a response token and an encrypted application-specific private key derived from the top-level private key and an identifier specific to the decentralized application;
transmitting the response token to the storage server with the application-specific private key, the application-specific private key providing access to a storage location on the storage server that is configured to store data that is specific to the user and the decentralized application.
11. The method of claim 10 , wherein the response token comprises fields reflecting data-access permissions requested by the decentralized application.
12. The method of claim 10 , wherein the authenticator application is a browser comprising navigation icons and a display area configured to display graphics and human-readable content.
13. The method of claim 10 , wherein the response token is a JSON web token.
14. The method of claim 10 , wherein receiving the user selection to login from the decentralized application initiates a method call that sends the access token to the authenticator application.
15. The method of claim 10 , further comprising with the decentralized application, generating an ephemeral transit key for the decentralized application; and
passing a public portion of the transit key in a field of the access token, wherein the received encrypted application-specific private key is encrypted with the public portion of the transit key.
16. A non-transitory, computer-readable storage medium comprising computer-executable instructions for authenticating a user with a client computing device of a decentralized network, wherein the computer-executable instructions, when executed by a computer system, cause the client computer to:
execute a first session of a decentralized application and a second session of an authenticator application distinct from the first session, the authenticator application having access to a top-level private key specific to a user and the decentralized application having no access to the top-level private key;
in response to a user selection to login, transmit via a first uniform resource locator (URL) query string from the first session of the decentralized application, an access token to the second session of the authenticator application, the access token authorizing the decentralized application to read or write data to or from the storage server on behalf of the user;
receive via a second URL query string from the authenticator application a response token and an encrypted application-specific private key derived from the top-level private key and an identifier specific to the decentralized application;
transmit the response token to the storage server with the application-specific private key, the application-specific private key providing access to a storage location on the storage server that is configured to store data that is specific to the user and the decentralized application.
17. The non-transitory, computer-readable storage medium of claim 16 , wherein the response token comprises fields reflecting data-access permissions requested by the decentralized application.
18. The non-transitory, computer-readable storage medium of claim 16 , wherein the authenticator application is a browser comprising navigation icons and a display area configured to display graphics and human-readable content.
19. The non-transitory, computer-readable storage medium of claim 16 , wherein receiving the user selection to login from the decentralized application initiates a method call that sends the access token to the authenticator application.
20. The non-transitory, computer-readable storage medium of claim 16 , wherein the computer-executable instructions, when executed by a computer system, further cause the client computer to
with the decentralized application, generate an ephemeral transit key for the decentralized application; and
pass a public portion of the transit key in a field of the access token, wherein the received encrypted application-specific private key is encrypted with the public portion of the transit key.