Technologies for token-based authentication and authorization of distributed computing resources

1. A method for token-based access authorization to an application program interface (API), the method comprising:

receiving, from a remote computing device, a request message requesting access to an API of a server, the request message including a digitally signed license token comprising an unencrypted payload portion and a digital signature comprising a previously-generated hash value of the unencrypted payload portion encrypted with a private key of a cryptographic key pair;

decrypting the digital signature with a corresponding public key of the cryptographic key pair to obtain the previously-generated hash value;

generating a new hash value of the unencrypted payload portion;

determining whether the new hash value matches the previously-generated hash value;

upon determining that the new hash value matches the previously-generated hash value, generating a new digitally signed token, the new digitally signed token including one or more entitlements defining access rights of the remote computing device to access the API of the server;

transmitting the new digitally signed token to the server; and

forwarding the request message to the server.

2. The method of claim 1 , further comprising generating the digitally signed license token prior to receiving the request message from the remote computing device.

3. The method of claim 1 , wherein the unencrypted payload portion comprises a license identifier to uniquely identify the digitally signed license token, a unique key corresponding to an entity associated with the remote computing device, an expiration date to indicate a date on which the digitally signed license token expires, a key pair identifier to identify the cryptographic key pair, a hash algorithm type to identify a hash algorithm used to generate the digital signature, an encryption algorithm type to identify an encryption algorithm used to generate the digital signature, and a token format version to indicate a version of the digitally signed license token.

4. The method of claim 3 , wherein the unique key is embedded as an extended attribute within the unencrypted payload portion.

5. The method of claim 3 , further comprising generating the digitally signed license token prior to receiving the request message from the remote computing device, wherein generating the digitally signed license token comprises:

generating the license identifier to uniquely identify the digitally signed license token;

identifying the unique key corresponding to the entity associated with the remote computing device;

determining the expiration date for the digitally signed license token;

embedding the license identifier, unique key, expiration date, the key pair identifier, the hash algorithm type, the encryption algorithm type, and the token format version into the unencrypted payload portion in cleartext; and

generating the digital signature appended to the digitally signed license token.

6. The method of claim 5 , wherein generating the digital signature appended to the digitally signed license token comprises:

hashing the unencrypted payload portion with a hashing algorithm to generate the previously-generated hash value, wherein the hashing algorithm corresponds to the hash algorithm type; and

encrypting the previously-generated hash value with the private key of the cryptographic key pair as a function of an encryption algorithm corresponding to the encryption algorithm type.

7. The method of claim 1 , wherein receiving the request message from the remote computing device comprises receiving a forwarded request message from an API management server or from an application of an Independent Software Vendor (ISV) executing on the remote computing device.

8. An access management server for token-based access authorization to an application program interface (API), the access management server comprising logic stored in memory, which when executed by a processor of the access management server, causes the access management server to:

receive, from a remote computing device, a request message requesting access to an API of a server, the request message including a digitally signed license token comprising an unencrypted payload portion and a digital signature comprising a previously-generated hash value of the unencrypted payload portion encrypted with a private key of a cryptographic key pair;

decrypt the digital signature with a corresponding public key of the cryptographic key pair to obtain the previously-generated hash value;

generate a new hash value of the unencrypted payload portion;

determine whether the new hash value matches the previously-generated hash value;

upon determining that the new hash value matches the previously-generated hash value, generate a new digitally signed token, the new digitally signed token including one or more entitlements defining access rights of the remote computing device to access the API of the server;

transmit the new digitally signed token to the server; and

forward the request message to the server.

9. The access management server of claim 8 , wherein the logic further causes the access management server to generate the digitally signed license token prior to receipt of the request message from the remote computing device.

10. The access management server of claim 8 , wherein the unencrypted payload portion comprises a license identifier to uniquely identify the digitally signed license token, an unique key corresponding to an entity associated with the remote computing device, an expiration date to indicate a date on which the digitally signed license token expires, a key pair identifier to identify the cryptographic key pair, a hash algorithm type to identify a hash algorithm used to generate the digital signature, an encryption algorithm type to identify an encryption algorithm used to generate the digital signature, and a token format version to indicate a version of the digitally signed license token.

11. The access management server of claim 10 , wherein the unique key is embedded as an extended attribute within the unencrypted payload portion.

12. The access management server of claim 10 , wherein the logic further causes the access management to generate the digitally signed license token prior to receipt of the request message from the remote computing device, wherein generating the digitally signed license token comprises:

generate the license identifier to uniquely identify the digitally signed license token;

identify the unique key corresponding to the entity associated with the remote computing device;

determine the expiration date for the digitally signed license token;

embed the license identifier, unique key, expiration date, the key pair identifier, the hash algorithm type, the encryption algorithm type, and the token format version into the unencrypted payload portion in cleartext; and

generate the digital signature appended to the digitally signed license token.

13. The access management server of claim 12 , wherein generating the digital signature appended to the digitally signed license token comprises:

hash the unencrypted payload portion with a hashing algorithm to generate the previously-generated hash value, wherein the hashing algorithm corresponds to the hash algorithm type; and

encrypt the previously-generated hash value with the private key of the cryptographic key pair as a function of an encryption algorithm corresponding to the encryption algorithm type.

14. The access management server of claim 8 , wherein receiving the request message from the remote computing device comprises receiving a forwarded request message from an API management server or receiving the request message from an application of an Independent Software Vendor (ISV) executed on the remote computing device.

15. A system for token-based authentication and access authorization to an application program interface (API), the system comprising:

a remote computing device;

an access management server; and

a server;

wherein the access management server is configured to:

receive, from the remote computing device, a request message requesting access to an API of the server, the request message including a digitally signed license token comprising an unencrypted payload portion and a first digital signature comprising a previously-generated hash value of the unencrypted payload portion encrypted with a private key of a cryptographic key pair;

decrypt the first digital signature with a corresponding public key of the cryptographic key pair to obtain the previously-generated hash value;

generate a new hash value of the unencrypted payload portion;

determine whether the new hash value matches the previously-generated hash value;

upon determining that the new hash value matches the previously-generated hash value, generate a new digitally signed token, the new digitally signed token including one or more entitlements defining access rights of the remote computing device to access the API of the server and a second digital signature appended thereto;

transmit the new digitally signed token to the server; and

forward the request message to the server; and

wherein the server is configured to:

receive the new digitally signed token from the access management server;

verify the second digital signature appended to the new digitally signed token;

upon verifying the second digital signature, locally cache the new digitally signed token and associated entitlements;

receive the request message forwarded by the access management server;

determine, as a function of the locally-cached new digitally signed token and associated entitlements, whether the access to the API requested by the remote computing device is authorized; and

upon determining that access to the API is authorized, grant the remote computing device access to the API.

16. The system of claim 15 , wherein the access management server is further configured to generate the digitally signed license token prior to receipt of the request message from the remote computing device.

17. The system of claim 15 , wherein the unencrypted payload portion of the digitally signed license token comprises a license identifier to uniquely identify the digitally signed license token, a unique key corresponding to an entity associated with the remote computing device, an expiration date to indicate a date on which the digitally signed license token expires, a key pair identifier to identify the cryptographic key pair, a hash algorithm type to identify a hash algorithm used to generate the first digital signature, an encryption algorithm type to identify an encryption algorithm used to generate the first digital signature, and a token format version to indicate a version of the digitally signed license token.

18. The system of claim 17 , wherein the unique key is embedded as an extended attribute within the unencrypted payload portion.

19. The system of claim 17 , wherein the access management server is further configured to generate the digitally signed license token prior to receipt of the request message from the remote computing device, wherein generating the digitally signed license token comprises:

generate the license identifier to uniquely identify the digitally signed license token;

identify the unique key corresponding to the entity associated with the remote computing device;

determine the expiration date for the digitally signed license token;

embed the license identifier, unique key, expiration date, the key pair identifier, the hash algorithm type, the encryption algorithm type, and the token format version into the unencrypted payload portion in cleartext; and

generate the first digital signature appended to the digitally signed license token.

20. The system of claim 19 , wherein generating the first digital signature appended to the digitally signed license token comprises:

hash the unencrypted payload portion with a hashing algorithm to generate the previously-generated hash value, wherein the hashing algorithm corresponds to the hash algorithm type; and

encrypt the previously-generated hash value with the private key of the cryptographic key pair as a function of an encryption algorithm corresponding to the encryption algorithm type.