OAuth 2.0 MAC 토큰인증의 효율성 개선을 위한 무상태 난수화토큰인증

Abstract

OAuth 2.0 bearer token[1,2] and JWT(JSON web token)[3,4], current standard technologies for authentication andauthorization, use the approach of sending fixed token repeatedly to server for authentication that they are subject toeavesdropping attack, thus they should be used in secure communication environment such as HTTPS[6]. In OAuth 2.0MAC token[6] which was devised as an authentication scheme that can be used in non-secure communication environment,server issues shared secret key to authenticated client and the client uses it to compute MAC to prove the authenticity ofrequest, but in this case server has to store and use the shared secret key to verify user’s request. Therefore, it’s hard toprovide stateless authentication service. In this paper we present a randomized token authentication scheme which canprovide stateless MAC token authentication without storing shared secret key in server side. To remove the use of HTTPS,we utilize secure communication using server certificate and simple signature-based login using client certificate together withthe proposed randomized token authentication to achieve the fully stateless authentication service and we provide animplementation example.