基于OAuth 2.0扩展的客户端认证方案

OAuth 2.0 extensions based client authentication scheme

为解决OAuth 2.0中基于不记名令牌访问和缺少客户端认证到资源服务器的机制而遭到安全和隐私威胁的问题,利用所有权证明(proof-of-possession,PoP)安全机制对OAuth 2.0进行扩展,提出一种客户端认证到资源服务器的方案。通过引进PoP令牌和PoP密钥,由授权服务器实施PoP密钥与PoP令牌的绑定,资源服务器可通过验证客户端是否拥有与PoP令牌中相匹配的PoP密钥,认证客户端身份的真实性,有效解决客户端到资源服务器的认证和安全通信问题。详细讨论PoP密钥与PoP令牌的绑定机制以及两者的安全保护方法。

To solve the security and privacy threat problems in OAuth2.0caused by the access mechanism based on the bearer token and lackness of mechanism of client authentication to the resource server,a client authentication scheme was proposed by extending the functionality of the OAuth2.0based on the proof-of-possession(PoP)security mechanism.By importing the PoP token and PoP key and binding the PoP key to the PoP token by authorization server,the resource server could verify the authen-ticity of the client^s identity by verifying whether or not the client had possession of the PoP key matched with the PoP token,ef-fectively dealing with the issue of client authentication and secure communication with the resource server.The mechanism of binding PoP key to PoP token and their protection methods were discussed in detail.