Granted Patent B2

US 12,463,815 · App. 18/742,399 · Granted Nov 4, 2025

Inventor: Matthew Blasius (Grand Prairie, TX)

Assignee: Expel, Inc.

H04L9/3213H04L9/3247H04L9/40

Abstract

Claims (80)

1 . A method comprising:

identifying, via an authentication service, a target entity that corresponds to an application programing interface (API) request based on authentication data included in the API request;

obtaining, via an authorization service, a set of permissions that the target entity is allowed to perform within an online service;

generating, at the authorization service, a protobuf web token based on (i) the target entity and (ii) the set of permissions associated with the target entity, wherein generating the protobuf web token includes:

generating a header object, wherein generating the header object includes encoding the header object based on a protobuf-header encoding protocol defined by the authorization service, wherein the header object, when encoded, includes instructions for a downstream service or downstream component of the online service to decode and validate the protobuf web token, and

serializing, via a serialization algorithm, the header object into a serialized header byte array;

adapting the API request to an adapted API request based on generating the protobuf web token, wherein the adapted API request includes the protobuf web token; and

executing, via a network, the adapted API request based on an API-processing service receiving the adapted API request.

2 . The method according to claim 1 , wherein:

identifying the target entity that corresponds to the API request includes assessing, via the authentication service, the authentication data of the API request against a repository of valid authentication data of the online service.

3 . The method according to claim 2 , wherein:

the repository of valid authentication data includes one or more pieces of genuine authentication data of each user associated with the online service, and

each of the one or more pieces of genuine authentication data provides a subject user a capability of accessing at least a portion of the online service.

4 . The method according to claim 2 , wherein:

the authentication data includes an API key associated with the target entity,

the repository of valid authentication data includes a set of valid API keys, and

the method further includes confirming an authenticity of the authentication data by evaluating the API key associated with the target entity against the set of valid API keys.

5 . The method according to claim 4 , wherein:

each valid API key of the set of valid API keys corresponds to a distinct entity subscribing to the online service and is authorized for use within the online service.

6 . The method according to claim 1 , wherein:

generating the protobuf web token includes generating a payload object, wherein generating the payload object includes:

encoding the payload object based on a protobuf-payload encoding protocol defined by the authorization service, wherein the payload object, when encoded, includes a representation of the target entity and a representation of the set of permissions associated with the target entity;

the method further includes:

serializing, via the serialization algorithm, the payload object into a serialized payload byte array.

7 . The method according to claim 6 , wherein:

generating the protobuf web token includes generating a signature object, wherein generating the signature object includes:

generating a signature byte array based on a concatenation of the serialized header byte array and the serialized payload byte array;

the method further includes:

generating a cryptographic signature of the signature byte array based on providing, as input, the signature byte array to an asymmetrical signing algorithm.

8 . The method according to claim 7 , further comprising:

generating an encoded header based on providing the serialized header byte array, as input, to an encoding algorithm;

generating an encoded payload based on providing the serialized payload byte array, as input, to the encoding algorithm; and

generating an encoded signature based on providing the cryptographic signature, as input, to the encoding algorithm, wherein the protobuf web token includes the encoded header, the encoded payload, and the encoded signature.

9 . The method according to claim 1 , further comprising:

automatically determining, via the API-processing service, the protobuf web token is a valid web token based on the protobuf web token satisfying web token decoding and validation criteria defined by the API-processing service.

10 . The method according to claim 1 , wherein:

the target entity corresponds to one of a user, an API client, and a service account.

11 . The method according to claim 1 , wherein:

the set of permissions includes a plurality of read and write permissions granted to the target entity.

12 . The computer-implemented method according to claim 1 , wherein:

generating the protobuf web token includes generating a payload object, wherein generating the payload object includes:

encoding the payload object based on a protobuf-payload encoding protocol, wherein the payload object, when encoded, includes a representation of the target entity and a representation of the set of permissions associated with the target entity;

the computer-implemented method further includes:

serializing, via the serialization algorithm, the payload object into a serialized payload byte array.

13 . The computer-implemented method according to claim 12 , wherein:

generating the protobuf web token includes generating a signature object, wherein generating the signature object includes:

generating a signature byte array based on a concatenation of the serialized header byte array and the serialized payload byte array;

the computer-implemented method further includes:

generating a cryptographic signature of the signature byte array based on providing, as input, the signature byte array to an asymmetrical signing algorithm.

14 . The computer-implemented method according to claim 13 , further comprising:

generating an encoded header based on providing the serialized header byte array, as input, to an encoding algorithm;

generating an encoded payload based on providing the serialized payload byte array, as input, to the encoding algorithm; and

generating an encoded signature based on providing the cryptographic signature, as input, to the encoding algorithm, wherein the protobuf web token includes the encoded header, the encoded payload, and the encoded signature.

15 . A computer-implemented method comprising:

at an event detection and response service:

obtaining an application programming interface (API) request that includes an authorization header comprising authentication data;

identifying (a) the authentication data as valid authentication data and (b) a target entity that corresponds to the authentication data based on an assessment of the authentication data against a corpus of valid authentication data;

obtaining a set of permissions that the target entity is authorized to perform within the event detection and response service based on querying a repository of authorization data;

generating a protobuf web token based on (i) the target entity and (ii) the set of permissions, wherein generating the protobuf web token includes:

generating a header object, wherein generating the header object includes encoding the header object based on a protobuf-header encoding protocol,

the header object, when encoded, includes instructions for decoding and validating the protobuf web token, and

serializing, via a serialization algorithm, the header object into a serialized header byte array; and

based on generating the protobuf web token:

modifying the API request to include the protobuf web token; and

transmitting, via a network, the modified API request to a target API-processing service.

16 . A method for using digitally signed web tokens within an event detection and response service, the method comprising:

detecting, via an application programming interface (API) gateway, an API request that includes an authorization header comprising authentication data;

obtaining, via an authorization service of the API gateway, a set of permissions that a target entity associated with the API request is authorized to perform within the event detection and response service;

generating, at the authorization service of the API gateway, a protobuf web token that includes (1) a representation of the target entity and (2) a representation of the set of permissions granted to the target entity; and

based on generating the protobuf web token:

adapting, via one or more processors, the API request to an adapted API request, wherein the adapted API request includes a header component comprising the protobuf web token; and

executing, via a network, the adapted API request based on an API-processing service receiving the adapted API request.

17 . The method according to claim 16 , wherein:

generating the protobuf web token further includes selecting a target web tokenization scheme of a plurality of distinct web tokenization schemes based on one or more characteristics of the target entity;

the method further comprises:

using the target web tokenization scheme to generate the protobuf web token.

18 . The method according to claim 16 , wherein:

generating the protobuf web token further includes selecting a target web tokenization scheme of a plurality of distinct web tokenization schemes based on one or more characteristics of the API request;

the method further comprises:

using the target web tokenization scheme to generate the protobuf web token.

Assignments (2)

Continuity (5)

References Cited (24)