Centralized session key issuance and rotation
Embodiments relate to a system that may include a third-party server and a domain name system (DNS). The third-party server may be configured to receive a request for a session token from a named entity device for the named entity device to communicate with an application programming interface (API). The API may be associated with a domain. The third-party server may obtain the session token from the API. The third-party server may encrypt the session token with a public key corresponding to the named entity device to generate an encrypted session token. The DNS may be configured to receive the encrypted session token and publish a DNS record at a namespace of the DNS, the DNS record containing the encrypted session token for the named entity device to retrieve the session token. The named entity device may decrypt the encrypted session token by the private key stored at the device.
1. A system comprising:
a third-party server comprising one or more processors and memory, the memory storing computer code comprising instructions, the instructions, when executed by the one or more processors, cause the one or more processors to at least:
receive, by the third-party server from a named entity device, a request for a session token for the named entity device to communicate with an application programming interface (API), the API associated with a domain;
obtain, by the third-party server, the session token from the API; and
encrypt, by the third-party server, the session token with a public key corresponding to the named entity device to generate an encrypted session token; and
a domain name system (DNS) associated with the domain, the DNS configured to receive the encrypted session token and publish a DNS record at a namespace of the DNS, the DNS record containing the encrypted session token for the named entity device to retrieve the session token.
2. The system of claim 1 , wherein the instruction to obtain the session token from the API comprises instructions, when executed, cause the one or more processors to at least:
retrieve an API credential corresponding to the named entity device, the API credential stored at the third-party server;
transmit an API credential to the API for the API to generate the session token; and
receive the session token.
3. The system of claim 1 , wherein the instruction to obtain the session token from the API comprises instructions, when executed, cause the one or more processors to at least:
receive the session token from the API that periodically pushes refreshed session tokens to the third-party server.
4. The system of claim 1 , wherein the request from the named entity device for the session token corresponds to a query to the DNS.
5. The system of claim 1 , wherein the namespace is a delegated sub-namespace managed by the third-party server, the domain delegating the sub-namespace to the third-party server.
6. The system of claim 1 , wherein the session token is a first session token, and the instructions, when executed by the one or more processors, further cause the one or more processors to at least:
obtain, by the third-party server and responsive to the first session token being expired or close to expiration, a second session token from the API;
encrypt, by the third-party server, the second session token with the public key corresponding to the named entity device; and
publish, by the third-party server, the second session token encrypted by the public key at the namespace of the DNS for the named entity device to retrieve the second session token at the DNS.
7. The system of claim 1 , wherein the public key is obtained from a DNS record associated with the named entity device.
8. The system of claim 1 , wherein the public key is stored at the third-party server.
9. The system of claim 1 , wherein the DNS record includes a time to live entry that corresponds to a lifetime of the session token.
10. The system of claim 1 , wherein the named entity device is an Internet-of-Thing (IoT) device that stores a private key corresponding to the public key at a hardware secure element.
11. A computer-implemented method comprising:
receiving, by a third-party server from a named entity device, a request for a session token for the named entity device to communicate with an application programming interface (API), the API associated with a domain;
obtaining, by the third-party server, the session token from the API;
encrypting, by the third-party server, the session token with a public key corresponding to the named entity device to generate an encrypted session token; and
publishing, by the third-party server, a domain name system (DNS) record at a namespace of a DNS associated with the domain, the DNS record containing the encrypted session token for the named entity device to retrieve the session token at the DNS.
12. The computer-implemented method of claim 11 , wherein obtaining the session token from the API comprises:
retrieving an API credential corresponding to the named entity device, the API credential stored at the third-party server;
transmitting an API credential to the API for the API to generate the session token; and
receiving the session token.
13. The computer-implemented method of claim 11 , wherein obtaining the session token from the API comprises:
receiving the session token from the API that periodically pushes refreshed session tokens to the third-party server.
14. The computer-implemented method of claim 11 , wherein the request from the named entity device for the session token corresponds to a query to the DNS.
15. The computer-implemented method of claim 11 , wherein the namespace is a delegated sub-namespace managed by the third-party server, the domain delegating the sub-namespace to the third-party server.
16. The computer-implemented method of claim 11 , wherein the session token is a first session token, and the computer-implemented method further comprises:
obtaining, by the third-party server and responsive to the first session token being expired or close to expiration, a second session token from the API;
encrypting, by the third-party server, the second session token with the public key corresponding to the named entity device; and
publishing, by the third-party server, the second session token encrypted by the public key at the namespace of the DNS for the named entity device to retrieve the second session token at the DNS.
17. The computer-implemented method of claim 11 , wherein the public key is obtained from a DNS record associated with the named entity device.
18. The computer-implemented method of claim 11 , wherein the public key is stored at the third-party server.
19. The computer-implemented method of claim 11 , wherein the DNS record includes a time to live entry that corresponds to a lifetime of the session token.
20. A non-transitory computer-readable medium configured to store computer code comprising instructions, the instructions, when executed by one or more processors, cause the one or more processors to at least:
receive, by a third-party server from a named entity device, a request for a session token for the named entity device to communicate with an application programming interface (API), the API associated with a domain;
obtain, by the third-party server, the session token from the API; and
encrypt, by the third-party server, the session token with a public key corresponding to the named entity device to generate an encrypted session token; and
publish a domain name system (DNS) record at a namespace of a DNS associated with the domain, the DNS record containing the encrypted session token for the named entity device to retrieve the session token.