BUSINESS METHOD INCLUDING CHALLENGE-RESPONSE SYSTEM TO SECURELY AUTHENTICATE SOFTWARE APPLICATION PROGRAM INTERFACES (APIs)
A system for securely authenticating software Application Program Interfaces (APIs) includes a handshake protocol that is provided to validate whether the parties involved are licensed to use the system which includes rights to Intellectual Property (IP) and corresponding obligations. The handshake is a Challenge-Response protocol that includes several steps. First, a Claimant sends a request to a Verifier requesting access to a function through an API. The Verifier reacts to the request by outputting a Challenge that is sent to the Claimant. The Challenge is also retained by the Verifier for use in its internal calculation to verify the Claimant's response. The Claimant next processes the Challenge using components under the license, known as Hook IP, and issues a Response to the Verifier. The Verifier compares the possibly-correct Candidate Response from the Claimant to the known-correct Target Response and if a match occurs the Verifier allows the Claimant access to the API.
1 . A method for providing a handshake between a Claimant and a Verifier to allow secure authentication of an Application Program Interface (API), both the Claimant and Verifier including a processor and memory for storing code enabling the processor to perform steps of the method, the method comprising:
receiving a request at the Verifier for access to support software to enable access to the API by the Claimant;
providing from the Verifier a challenge comprising a random number or a non-repeating numerical value that had not been previously used by the Verifier;
receiving a Response to the Challenge from the Claimant at the Verifier, wherein the Response is calculated as a function over the challenge value;
verifying the Response using the Verifier; and
returning an acknowledgement from the Verifier to the Claimant when the Response is verified indicating that the support service for access to the API is available.
2 . The method of claim 1 , wherein the function can be calculated based on data received from access to a license agreement for licensing Intellectual Property (IP) rights referred to as Hook IP.
3 . The system of claim 2 , wherein the Hook IP imposes obligations for compliance by hardware receiving data from the Claimant.
4 . The system of claim 2 , wherein the Hook IP imposes obligations for compliance by software receiving data from the Claimant.
5 . The method of claim 1 , wherein after returning an acknowledgement, the Verifier returns an API handle that the Claimant may subsequently pass to the Verifier in order to prove it has been authorized.
6 . The method of claim 1 , wherein the function includes Administrative Information that comprises one or more of a unique ID, unique name, or a name of the Claimant.
7 . The method of claim 1 , wherein the function includes an Application Class that provides secret information that enables verification of the Challenge.
8 . The method of claim 1 , wherein after acknowledgement data is encrypted for transfer from the Claimant through the API.
9 . The method of claim 8 , wherein with the Claimant will pass decryption keys through the API with the data.
10 . The system of claim 1 , wherein the Challenge and the Response are not encrypted.
11 . The system of claim 1 , wherein the Verifier retains the Challenge and creates a Target Response from the Challenge that is compared with the Response provided by the Claimant to determine if a match occurs for the verification.