Set up key authentication

Available in Classic and VPC

The newly provided encryption/decryption APIs have several differences from the existing encryption/decryption APIs that used NAVER Cloud Platform account information as authentication credentials. The new APIs provided in Key Management Service (KMS) API 2.0 have the following differences compared to the existing API 1.0:

Key request token overview

The tokens used in encryption/decryption API requests of KMS API 2.0 are configured in a self-defined JWT (JSON Web Token) format.

Token structure

Access tokens and refresh tokens are tokens used for user authentication and permissions, with different roles considering security and efficiency.

• Access token
  An access token is a short-lived token used when clients access resource servers (such as APIs). After a user or service is certified, they can access authorized resources using this token. Access tokens are valid for only a short time (few minutes-few hours) as a measure to enhance security. This is because even if a token is leaked, the short validity period minimizes potential damage.
  However, when authentication tokens have short validity periods, the cumbersome user authentication procedure to obtain new tokens must be performed more frequently. Refresh tokens are used to compensate for this.

• Refresh token
  A refresh token is used to obtain a new access token when the validity period of an access token expires. Through this, you can continuously use services without having to perform user authentication (e.g., login) again.
  Refresh tokens have a much longer validity period (days-months) than access tokens. However, to minimize permissions, they generally cannot be used to access resources like access tokens can.

JWT (JSON Web Token) method

To efficiently use individual authentication tokens per key, KMS API 2.0 uses JWT (JSON Web Token) method instead of managing tokens independently. Here is an example of tokens:

Token-based authentication flow (example)

1. To sign and issue tokens per key, the key admin sets up a token creator.
2. When the token creator is set up, a token pair is issued using the console or Create Token Set API. User authentication is required at this point.
3. The client makes key encryption/decryption requests using the access token, and when the request is rejected due to the token's expiration, uses the refresh token to request a new access token.
4. When a new access token is issued, the client can make key encryption/decryption requests again. If the refresh token has expired, you need to go through user authentication again to issue new tokens.

Set up authentication

Enable/Disable token creator

To use the token authentication feature, you need to configure a token creator first. To enable and disable the token creator:

1. From the NAVER Cloud Platform console, navigate to Menu > Services > Security > Key Management Service > Key.
2. Select the key and move to the Set up authentication tab, then click Enable token creator to configure the token creator.
3. When the token creator is initialized, a token creator ID is assigned, and tokens can now be issued.
   
4. Click Disable token creator to discard the token creator, and it no longer processes token authentication.

Replace token creator

You can also replace just the token creator while maintaining the token authentication functionality. To replace the token creator:

1. From the NAVER Cloud Platform console, navigate to Menu > Services > Security > Key Management Service > Key.
2. Select the key and move to the Set up authentication tab, then check the token creator ID.
3. Click the Replace button next to the token creator to replace the token creator.

Create token

When a token creator is configured, tokens can be issued.

1. From the NAVER Cloud Platform console, navigate to Menu > Services > Security > Key Management Service > Key.
2. Select the key and move to the Set up authentication tab, then check the token creator ID.
3. Click Create token and enter the validity period.
   • Refresh token TTL: Enter in hours. Can be set from a minimum of 1 hour to a maximum of 17,520 hours (730 days). If not entered, it defaults to 2,160 hours (90 days).
   • Access token TTL: Enter in hours. Can be set from a minimum of 1 hour to a maximum of 17,520 hours (730 days). If not entered, it defaults to 72 hours (3 days).
4. Click OK to verify the issued tokens. When the token issuance popup closes, the issued tokens will be lost.
   

Token

IP ACL settings

To prevent token misuse from unauthorized clients, you can specify the IP addresses of requesters who are authorized to use tokens.

1. From the NAVER Cloud Platform console, navigate to Menu > Services > Security > Key Management Service > Key.
2. Select the key and move to the Set up authentication tab, then check IP ACL to enable it. Tokens issued after IP ACL is enabled undergo request IP address validation.
   Caution

   • When IP ACL is enabled, it operates as "All Deny'" by default. Therefore, when activating the IP ACL feature, you must register allowed IP addresses for tokens to be used properly.
   • Additionally, tokens issued before IP ACL activation also undergo request IP address validation. If tokens issued before IP ACL activation are not requested from allowed IP addresses, the validation fails.
3. Enter the IP address and click Add to register it to the allowed list. IP addresses are allowed immediately upon registration.
4. If there are IP addresses you wish to delete, click the Delete button next to the item to remove it from the allowed list. IP addresses are denied immediately upon deletion.