はじめに
対話型AIプラットフォーム
チャットボットの概要
自然言語処理(NLP)
ボットの概念と用語
クイックスタートガイド
プラットフォームへのアクセス
ボットビルダーの操作
リリースノート
最新バージョン(英語)
以前のバージョン(英語)
廃止機能(英語)
コンセプト
設計
ストーリーボード
ダイアログタスク
ダイアログタスクとは
ダイアログビルダー
ノードタイプ
インテントノード
ダイアログノード
エンティティノード
フォームノード
確認ノード
ロジックノード
ボットアクションノード
サービスノード
Webhookノード
スクリプトノード
グループノード
エージェント転送ノード
ユーザープロンプト
音声通話プロパティ
イベント ハンドラー
ナレッジグラフ
ナレッジグラフの抽出
ナレッジグラフの構築
ボットにナレッジグラフを追加
グラフの作成
ナレッジグラフの構築
既存のソースからFAQを構築
通知タスク
スモールトーク
デジタルスキル
デジタルフォーム
デジタルビュー
デジタルビューとは
パネル
ウィジェット
トレーニング
トレーニングとは
機械学習
機械学習とは
モデル検証
ファンダメンタルミーニング
ナレッジグラフ
示唆
ランキングおよび解決
NLPの詳細設定
NLPのガイドライン
インテリジェンス
インテリジェンスとは
コンテキスト
コンテキストインテント
割り込み
複数インテントの検出
エンティティの変更
デフォルトの会話
センチメント管理
トーン分析
テストとデバッグ
ボットと会話
発話テスト
バッチテスト
会話テスト
デプロイ
チャネル
公開
分析
ボットの分析
NLPメトリクス
会話フロー
Usage Metrics
封じ込め測定
カスタムダッシュボード
カスタムダッシュボードとは
メタタグ
カスタムダッシュボードとウィジェット
LLM and Generative AI
Introduction
LLM Integration
Kore.ai XO GPT Module
Prompts & Requests Library
Co-Pilot Features
Dynamic Conversations Features
ユニバーサルボット
ユニバーサルボットとは
ユニバーサルボットの定義
ユニバーサルボットの作成
ユニバーサルボットのトレーニング
ユニバーサルボットのカスタマイズ
他言語の有効化
ストア
プラントと使用
Overview
Usage Plans
Support Plans
Invoices
管理
ボット認証
複数言語対応ボット
個人を特定できる情報の編集
ボット変数の使用
IVRのシステム連携
一般設定
ボット管理
ハウツー
会話スキルの設計
バンキングボットを作成
バンキングボット – 資金の振り替え
バンキングボット – 残高を更新
ナレッジグラフを構築
スマートアラートの予約方法
Integrations
Actions
Actions Overview
Asana
Configure
Templates
Azure OpenAI
Configure
Templates
BambooHR
Configure
Templates
Bitly
Configure
Templates
Confluence
Configure
Templates
DHL
Configure
Templates
Freshdesk
Configure
Templates
Freshservice
Configure
Templates
Google Maps
Configure
Templates
Here
Configure
Templates
HubSpot
Configure
Templates
JIRA
Configure
Templates
Microsoft Graph
Configure
Templates
Open AI
Configure
Templates
Salesforce
Configure
Templates
ServiceNow
Configure
Templates
Stripe
Configure
Templates
Shopify
Configure
Templates
Twilio
Configure
Templates
Zendesk
Configure
Templates
Agents
Agent Transfer Overview
Custom (BotKit)
Drift
Genesys
Intercom
NiceInContact
NiceInContact(User Hub)
Salesforce
ServiceNow
Configure Tokyo and Lower versions
Configure Utah and Higher versions
Unblu
External NLU Adapters
Overview
Dialogflow Engine
Test and Debug
デジタルスキルの設計
デジタルフォームの設定方法
デジタルビューの設定方法
データテーブルのデータの追加方法
データテーブルのデータの更新方法
Add Data from Digital Forms
ボットのトレーニング
示唆の使用方法
インテントとエンティティのパターンの使用方法
コンテキスト切り替えの管理方法
ボットのデプロイ
エージェント転送の設定方法
ボット関数の使用方法
コンテンツ変数の使用方法
グローバル変数の使用方法
ボットの分析
カスタムダッシュボードの作成方法
カスタムタグを使ってフィルタリング
Data
Overview
Data Table
Table Views
App Definitions
Data as Service
Build a Travel Planning Assistant
Travel Assistant Overview
Create a Travel Virtual Assistant
Design Conversation Skills
Create an ‘Update Booking’ Task
Create a Change Flight Task
Build a Knowledge Graph
Schedule a Smart Alert
Design Digital Skills
Configure Digital Forms
Configure Digital Views
Train the Assistant
Use Traits
Use Patterns
Manage Context Switching
Deploy the Assistant
Use Bot Functions
Use Content Variables
Use Global Variables
Use Web SDK
Build a Banking Assistant
Migrate External Bots
Google Dialogflow Bot
APIs & SDKs
API Reference
API Introduction
Rate Limits
API List
koreUtil Libraries
SDK Reference
SDK Introduction
Web SDK
How the Web SDK Works
SDK Security
SDK Registration
Web Socket Connect and RTM
Tutorials
Widget SDK Tutorial
Web SDK Tutorial
BotKit SDK
BotKit SDK Deployment Guide
Installing the BotKit SDK
Using the BotKit SDK
SDK Events
SDK Functions
Tutorials
BotKit - Blue Prism
BotKit - Flight Search Sample VA
BotKit - Agent Transfer
  1. ホーム
  2. Docs
  3. Virtual Assistants
  4. SDKs
  5. SDK Security

SDK Security

The Kore.ai XO Platform only accepts clients that are authorized to connect and exchange messages. You must register your SDK app with the Kore.ai XO Platform in the XO Platform tool and acquire client credentials. You can then use your client credentials to authorize the app and communication exchange between your user, bot, and the XO Platform.

Securing Your SDKs

Using Kore.ai SDKs, you can create secure interactions with the Kore.ai XO Platform.
Kore.ai SDK libraries can be embedded with web or mobile applications to make HTTPS calls and establish web socket connections with the Kore.ai XO Platform on behalf of a user of your application chatting with a Kore.ai bot.
To establish identity and initiate a secure web session:

  • Your application SDK should sign and send the identity of the user to the Kore.ai XO Platform
  • The Kore.ai XO Platform verifies the signature to establish trust with your application using:
    • JSON Web Token (JWT) – Used to send the user identity to Kore.ai XO Platform
    • Bearer Token – Your application SDK exchanges the JWT for a bearer token used for subsequent calls

About JWT

Kore.ai uses the JWT (JSON Web Token) mechanism to handle the authentication.

JWT Flow

The following diagram depicts a typical JWT flow in Kore.ai XO Platform.

JWT Tokens

JSON Web Tokens consist of three parts separated by dots ” .  ” as:

  • Header
  • Payload
  • Signature

using the hhhhh.ppppp.sssss syntax where h represents the header, p the payload, and s representing the signature.

JWT Header

The JWT Header defines the token type, which is JWT, and the security algorithm, for example,

{
   "alg": "HS256",
   "typ": "JWT"
}

The JWT type can be one of:

  • HS256 / HS512 (HMAC with SHA-256 / SHA-512) – These algorithms use a Secret Key to sign the token. The Secret Key is generated when the app is registered on the XO Platform when defining your bot’s Web/Mobile Client channel.
  • RS256 / RS512 (RSA signature with SHA-256 / SHA-512) – These are RSA public/private key-based algorithms to sign and verify the token. The client Public Key is defined when the app is registered on the XO Platform. The client app signs the token using a Private Key, and the XO Platform verifies this token using the Public Key.

To use these JWT types for your bot, you need to register your application and select the algorithm type. For more information about using JWT, see  https://tools.ietf.org/html/rfc7519 and https://jwt.io/introduction/.

JWT Payload

The SDK client needs to assert the user by generating unique JSON Web Token using your app registration credentials created in XO Platform when you defined the Web/Mobile Client channel for your bot and the identity of your app user.

The following example shows a sample payload used to generate the JWT.
Sample Header

{
    "alg": "HS256",
    "typ": "JWT"
}

Sample Payload

{
    "iat": 1466684723,
    "exp": 1466684783,
    "jti": "1234",               //or kore_jti
    "aud": "https://idproxy.kore.ai/authorize",
    "iss": "cs-xxxxxxxxxx-1234", //or kore_iss
    "sub": "john.doe@achme.com", //or kore_sub
    "isAnonymous": false,
    "identityToMerge": "anonymoususer1@test.com" //to map anonymous user
}

The following table describes the parameters for the JWT Header and Payload.

Parameter Description Type
alg A drop-down list of security algorithms. One of:

  • RS256/RS512: Select to enable the Public Key. The Private key, used for encryption, is provided by the user, and the Public key, used for decryption, is provided by the Platform. Both the keys have to be used for generating the token. The Public Key is used by the XO Platform to authenticate the client application.
  • HS256/HS512: Select to generate a Secret Key and a Client ID. The Client ID is required for app initialization, and the Secret Key is used by the XO Platform to authenticate the client application.
string
typ The token type. For JSON Web Token, enter JWT. string
iat The date/time that the token was issued. This value should be in seconds. integer
exp The date/time that the token expires. This value should be in seconds. integer
jti

or kore_jti
(optional)

A jti claim which can be used to prevent replay attacks:

The “jti” (JWT ID) claim provides a unique identifier for the JWT. The identifier value MUST be assigned in a manner that ensures that there is a negligible probability that the same value will be accidentally assigned to a different data object; if the application uses multiple issuers, collisions MUST be prevented among values produced by different issuers as well. The “jti” claim can be used to prevent the JWT from being replayed. The “jti” value is a case-sensitive string. Use of this claim is OPTIONAL.” (ref)

NOTE: Use kore_jti to bypass the pre-populated value for jti with Kore specific values

string
aud The audience that the token is intended for. For Kore.ai, the audience is https://idproxy.kore.com/authorize. string
iss

or kore_iss

The ClientID of the client application. The ClientID is generated when the app is registered in the Kore.ai XO Platform.

NOTE: Use kore_iss to bypass the pre-populated value for iss with Kore specific values

string
sub

or kore_sub

The token subject which is represented by the email ID or phone number for users who are logged in the client application system. For anonymous users, the client app can generate a unique random ID and assign that ID to this field.

NOTE: Use kore_sub to bypass the pre-populated value for sub with Kore specific values

string
isAnonymous When set to true, the user is an anonymous user for the client application system. Anonymous users are not persisted on the Kore.ai Platform. Default setting is false. boolean
identityToMerge The anonymous Identity that needs to be merged into known user
refer here for details
string

jti Validations

In case jti claim is passed as part of the JWT payload, the Platform performs the following validations:

  1. Expiry to be less than or equal to 1 hour: In case of failing to meet this requirement the following response is sent:
    {"errors":[{"msg":"error verifying the jwt: if \"jti\" claim \"exp\" must be <= 1 hour(s)","code":401}]}
  2. Restricts replay of XHR: The following response is sent in case of non-compliance:
    {"errors":[{"msg":"error verifying the jwt: possibly a replay","code":401}]}

Hosting the JWT Generation Web Service

The Kore.ai SDK libraries and UI widgets are integrated directly into your client applications, and you will need to generate the JWT from your server.

  • For the Web SDK, the SDK libraries are run from the user’s browser.
  • For mobile SDKs, the SDK libraries are run from a user’s mobile phone.

You need to host the JWT generation as a REST web service for security because the Client Secret or RSA Private Key is required for JWT generation and should not be hosted at the client application. You can make the REST web service directly available to SDK libraries or have your application call the JWT generation web service at the backend to make the JWT available to the SDK libraries.
When making the JWT generation web service available to the SDK libraries, you should keep the Client ID, Client Secret, and any key expiration logic on the server-side and expect only the user ID from the client.

There are several open-source libraries available to generate JWT, for example,

To generate credentials for your clients, you must register your client app in the XO Platform tool. For more information, see SDK App Registration.

You can also try out our tutorial using a Kore.ai sample bot, a test application, and configuring your localhost server for JWT generation. For more information, see the Kore.ai Web SDK Tutorial.

JSON Web Encryption (JWE)

JWT is used to send user identity in a secure form by signing the payload using the Secret Key(HS-256 algorithm) or RSA Private Key(RS-256 algorithm). There can be a requirement to send additional user data along with user identity in JWT using the “secureCustomData” or “privateClaims” key and make them available in the dialog execution context through the UserContext variable (for example, context.session.UserContext.privateClaims.accountId). This additional data may be sensitive information. Hence, we need to send it in encrypted form. JWE (JSON Web Encryption) is an IETF standard that provides a way to send the JWT in an encrypted form.

A basic implementation involves creating a JWE object, specifying encryption algorithms, and then encrypting the payload.

About JWE Token

A JWE token is a compact, URL-safe means of representing encrypted content using JSON-based data structures. It enables the secure transmission of encrypted data that can only be decrypted by the intended recipient.

The token contains the following five parts:

  • Header,
  • JWE Encrypted Key (CEK),
  • Initialization Vector,
  • CipherText, and
  • Authentication Tag

Header

The header part can have the following attributes:

  • “alg” (Algorithm): defines the algorithm for content key wrapping
    Following algorithms are supported:
    • RSA-OAEP,
    • RSA1_5
  • “enc” (Encryption Algorithm): defines the algorithm for content encryption
    Following algorithms are supported for content encryption:

    • A128CBC-HS256
    • A128GCM
    • A256GCM
  • “kid” (Key ID): Key Id of Kore Platform’s public key. This will be displayed when you enable the JWE on the XO Platform.
  • “typ” (Token Type): This will have JWT as a value since the wrapped content is JWT.

Below is the decoded sample JWE header:
{
"alg": "RSA-OAEP",
"enc": "A128CBC-HS256",
"kid": "k-ffb4hty69-750a-44af-91c1-de0bvcf6a",
"typ": "JWT"
}

JWE Encrypted Key (CEK)

A symmetric key is generated to encrypt the payload using the algorithm specified in “enc” field of the header. This key is encrypted using Kore.ai Public Key using the algorithm specified in “alg” field of the header.

Initialization Vector

This is used in the encryption of the payload (JWT).

CipherText

This contains encrypted content of the payload. This is encrypted using the algorithm specified in “enc” field of the header using the initialization vector.

Authentication Tag

The Authentication tag is generated when authenticated encryption is performed using the algorithm specified in “enc” field of the header. This is used during decryption to ensure integrity.

How to Generate a JWE Token?

Generating a JWE token involves the following steps:

  1. Choose a JWE Library: Choose a programming language and library that supports JWE. There are libraries available for various languages, such as Python (`PyJWT`), Java (`javax.crypto`), Node.js (`node-jose`), etc.
  2. Prepare Your Payload: The payload is the data you want to encrypt and include in the JWE token. It can be a JSON object.
  3. Choose Encryption Algorithms: Common algorithms include “RSA-OAEP” for asymmetric encryption and “A256GCM” for symmetric encryption with AES-GCM.
  4. Generate or Obtain Encryption Keys: You will need encryption keys depending on the chosen algorithm. For asymmetric encryption, you’ll need a public key; for symmetric encryption, you’ll need a shared secret key.
  5. Create the JWE Token: Use your JWE library to create the JWE token. Here’s a Python example using the `PyJWT` library:
    import jwt
    
    # Sample payload data you want to include in the JWE token
    # Use the "PrivateClaims" or "SecureCustomData" key to securely pass additional 
    # data to the Platform
    payload = {
        "sub": "1234567890",
        "name": "John Doe",
        "iat": 1516239022,
        "privateClaims": {
          "accountId": "123412512512556",
          "fusionSid": "12125125125",
          "siteId": "124125125125"
        }
    }
    # Sample encryption key (the shared secret key used for encryption)
    secret_key = "MySecretKey123"
    # Create the JWE token
    jwe_token = jwt.encode(
        payload,
        secret_key,
        algorithm='HS256',  # Algorithm for signature (HMAC SHA-256)
        headers={"alg": "A256GCM"}  # Algorithm for encryption (AES-GCM)
    )
    print("JWE Token:", jwe_token)
    

You can now use the generated JWE token in your application.

Find the Kore.ai JWE Public Key

The Kore.ai Public Key is displayed in JWK format when you enable the JWE option while creating an SDK app. You can use this in your client library to generate JWE.

Verify and Decrypt the JWE

Let’s see an example of how you can verify and decrypt the JWE, assuming you have a JWE token (containing the payload that was encrypted using a private key), and have access to the corresponding JWE public key. The example below is in Python using the ‘PyJWT’ library; your implementation may vary depending on the language and the library you’re using.

  1. Import Libraries: Ensure you have the necessary libraries installed. In this example, you need `PyJWT` for handling JWTs and JWEs.
  2. Load the Public Key: Load the JWE public key in the form of a JSON Web Key (JWK); for example, the Kore.ai JWE Public Key as shown in the previous section.
  3. Decode and Verify: Use the public key to verify and decrypt the JWE.
  4. Putting it all together: Here’s a Python example using the `PyJWT` library:
    import jwt
    
    # Sample JWE token
    jwe_token = "eyJhbGciOiJSUzI1NiIs...JWE Ciphertext and other components...UkSIsIm4iOiJqYW1lc3RpY3Nl..."
    
    # Sample JWE public key (in JWK format)
    jwe_public_key = {
          "e": "AQAB",                 
          "kid": "de668337-....-....-....-5778944f9630",
          "kty": "RSA",
          "n": "rdqXc48aW...uNMSdIgn"
    }
    
    try:
        decoded_payload = jwt.decode(
            jwe_token,
            jwe_public_key,
            algorithms=['RS256'],  # Algorithm used for signature verification
            options={"verify_signature": True, "decrypt": True}
        )
        print("Decoded Payload:", decoded_payload)
    except jwt.ExpiredSignatureError:
        print("JWE Signature has expired.")
    except jwt.DecodeError:
        print("Invalid JWE Signature or Decryption failed.")
    

In this example code:

  • ‘jwe_token` is the JWE that you want to verify and decrypt.
  • The `jwt.decode` function is used to decode and verify the JWE.
  • The public key is used as the key for signature verification and decryption.
  • The `”verify_signature”: True` option indicates that the library should verify the signature.
  • The `”decrypt”: True` option tells the library to attempt decryption of the JWE.
  • The `algorithms` parameter specifies the algorithm used for signature verification that should match the algorithm used when creating the JWE.

If the JWE token is valid and the signature can be verified, the payload will be successfully decoded and printed.

For more information about JWE, refer to https://tools.ietf.org/html/rfc7516.

SDK Security

The Kore.ai XO Platform only accepts clients that are authorized to connect and exchange messages. You must register your SDK app with the Kore.ai XO Platform in the XO Platform tool and acquire client credentials. You can then use your client credentials to authorize the app and communication exchange between your user, bot, and the XO Platform.

Securing Your SDKs

Using Kore.ai SDKs, you can create secure interactions with the Kore.ai XO Platform.
Kore.ai SDK libraries can be embedded with web or mobile applications to make HTTPS calls and establish web socket connections with the Kore.ai XO Platform on behalf of a user of your application chatting with a Kore.ai bot.
To establish identity and initiate a secure web session:

  • Your application SDK should sign and send the identity of the user to the Kore.ai XO Platform
  • The Kore.ai XO Platform verifies the signature to establish trust with your application using:
    • JSON Web Token (JWT) – Used to send the user identity to Kore.ai XO Platform
    • Bearer Token – Your application SDK exchanges the JWT for a bearer token used for subsequent calls

About JWT

Kore.ai uses the JWT (JSON Web Token) mechanism to handle the authentication.

JWT Flow

The following diagram depicts a typical JWT flow in Kore.ai XO Platform.

JWT Tokens

JSON Web Tokens consist of three parts separated by dots ” .  ” as:

  • Header
  • Payload
  • Signature

using the hhhhh.ppppp.sssss syntax where h represents the header, p the payload, and s representing the signature.

JWT Header

The JWT Header defines the token type, which is JWT, and the security algorithm, for example,

{
   "alg": "HS256",
   "typ": "JWT"
}

The JWT type can be one of:

  • HS256 / HS512 (HMAC with SHA-256 / SHA-512) – These algorithms use a Secret Key to sign the token. The Secret Key is generated when the app is registered on the XO Platform when defining your bot’s Web/Mobile Client channel.
  • RS256 / RS512 (RSA signature with SHA-256 / SHA-512) – These are RSA public/private key-based algorithms to sign and verify the token. The client Public Key is defined when the app is registered on the XO Platform. The client app signs the token using a Private Key, and the XO Platform verifies this token using the Public Key.

To use these JWT types for your bot, you need to register your application and select the algorithm type. For more information about using JWT, see  https://tools.ietf.org/html/rfc7519 and https://jwt.io/introduction/.

JWT Payload

The SDK client needs to assert the user by generating unique JSON Web Token using your app registration credentials created in XO Platform when you defined the Web/Mobile Client channel for your bot and the identity of your app user.

The following example shows a sample payload used to generate the JWT.
Sample Header

{
    "alg": "HS256",
    "typ": "JWT"
}

Sample Payload

{
    "iat": 1466684723,
    "exp": 1466684783,
    "jti": "1234",               //or kore_jti
    "aud": "https://idproxy.kore.ai/authorize",
    "iss": "cs-xxxxxxxxxx-1234", //or kore_iss
    "sub": "john.doe@achme.com", //or kore_sub
    "isAnonymous": false,
    "identityToMerge": "anonymoususer1@test.com" //to map anonymous user
}

The following table describes the parameters for the JWT Header and Payload.

Parameter Description Type
alg A drop-down list of security algorithms. One of:

  • RS256/RS512: Select to enable the Public Key. The Private key, used for encryption, is provided by the user, and the Public key, used for decryption, is provided by the Platform. Both the keys have to be used for generating the token. The Public Key is used by the XO Platform to authenticate the client application.
  • HS256/HS512: Select to generate a Secret Key and a Client ID. The Client ID is required for app initialization, and the Secret Key is used by the XO Platform to authenticate the client application.
string
typ The token type. For JSON Web Token, enter JWT. string
iat The date/time that the token was issued. This value should be in seconds. integer
exp The date/time that the token expires. This value should be in seconds. integer
jti

or kore_jti
(optional)

A jti claim which can be used to prevent replay attacks:

The “jti” (JWT ID) claim provides a unique identifier for the JWT. The identifier value MUST be assigned in a manner that ensures that there is a negligible probability that the same value will be accidentally assigned to a different data object; if the application uses multiple issuers, collisions MUST be prevented among values produced by different issuers as well. The “jti” claim can be used to prevent the JWT from being replayed. The “jti” value is a case-sensitive string. Use of this claim is OPTIONAL.” (ref)

NOTE: Use kore_jti to bypass the pre-populated value for jti with Kore specific values

string
aud The audience that the token is intended for. For Kore.ai, the audience is https://idproxy.kore.com/authorize. string
iss

or kore_iss

The ClientID of the client application. The ClientID is generated when the app is registered in the Kore.ai XO Platform.

NOTE: Use kore_iss to bypass the pre-populated value for iss with Kore specific values

string
sub

or kore_sub

The token subject which is represented by the email ID or phone number for users who are logged in the client application system. For anonymous users, the client app can generate a unique random ID and assign that ID to this field.

NOTE: Use kore_sub to bypass the pre-populated value for sub with Kore specific values

string
isAnonymous When set to true, the user is an anonymous user for the client application system. Anonymous users are not persisted on the Kore.ai Platform. Default setting is false. boolean
identityToMerge The anonymous Identity that needs to be merged into known user
refer here for details
string

jti Validations

In case jti claim is passed as part of the JWT payload, the Platform performs the following validations:

  1. Expiry to be less than or equal to 1 hour: In case of failing to meet this requirement the following response is sent:
    {"errors":[{"msg":"error verifying the jwt: if \"jti\" claim \"exp\" must be <= 1 hour(s)","code":401}]}
  2. Restricts replay of XHR: The following response is sent in case of non-compliance:
    {"errors":[{"msg":"error verifying the jwt: possibly a replay","code":401}]}

Hosting the JWT Generation Web Service

The Kore.ai SDK libraries and UI widgets are integrated directly into your client applications, and you will need to generate the JWT from your server.

  • For the Web SDK, the SDK libraries are run from the user’s browser.
  • For mobile SDKs, the SDK libraries are run from a user’s mobile phone.

You need to host the JWT generation as a REST web service for security because the Client Secret or RSA Private Key is required for JWT generation and should not be hosted at the client application. You can make the REST web service directly available to SDK libraries or have your application call the JWT generation web service at the backend to make the JWT available to the SDK libraries.
When making the JWT generation web service available to the SDK libraries, you should keep the Client ID, Client Secret, and any key expiration logic on the server-side and expect only the user ID from the client.

There are several open-source libraries available to generate JWT, for example,

To generate credentials for your clients, you must register your client app in the XO Platform tool. For more information, see SDK App Registration.

You can also try out our tutorial using a Kore.ai sample bot, a test application, and configuring your localhost server for JWT generation. For more information, see the Kore.ai Web SDK Tutorial.

JSON Web Encryption (JWE)

JWT is used to send user identity in a secure form by signing the payload using the Secret Key(HS-256 algorithm) or RSA Private Key(RS-256 algorithm). There can be a requirement to send additional user data along with user identity in JWT using the “secureCustomData” or “privateClaims” key and make them available in the dialog execution context through the UserContext variable (for example, context.session.UserContext.privateClaims.accountId). This additional data may be sensitive information. Hence, we need to send it in encrypted form. JWE (JSON Web Encryption) is an IETF standard that provides a way to send the JWT in an encrypted form.

A basic implementation involves creating a JWE object, specifying encryption algorithms, and then encrypting the payload.

About JWE Token

A JWE token is a compact, URL-safe means of representing encrypted content using JSON-based data structures. It enables the secure transmission of encrypted data that can only be decrypted by the intended recipient.

The token contains the following five parts:

  • Header,
  • JWE Encrypted Key (CEK),
  • Initialization Vector,
  • CipherText, and
  • Authentication Tag

Header

The header part can have the following attributes:

  • “alg” (Algorithm): defines the algorithm for content key wrapping
    Following algorithms are supported:
    • RSA-OAEP,
    • RSA1_5
  • “enc” (Encryption Algorithm): defines the algorithm for content encryption
    Following algorithms are supported for content encryption:

    • A128CBC-HS256
    • A128GCM
    • A256GCM
  • “kid” (Key ID): Key Id of Kore Platform’s public key. This will be displayed when you enable the JWE on the XO Platform.
  • “typ” (Token Type): This will have JWT as a value since the wrapped content is JWT.

Below is the decoded sample JWE header:
{
"alg": "RSA-OAEP",
"enc": "A128CBC-HS256",
"kid": "k-ffb4hty69-750a-44af-91c1-de0bvcf6a",
"typ": "JWT"
}

JWE Encrypted Key (CEK)

A symmetric key is generated to encrypt the payload using the algorithm specified in “enc” field of the header. This key is encrypted using Kore.ai Public Key using the algorithm specified in “alg” field of the header.

Initialization Vector

This is used in the encryption of the payload (JWT).

CipherText

This contains encrypted content of the payload. This is encrypted using the algorithm specified in “enc” field of the header using the initialization vector.

Authentication Tag

The Authentication tag is generated when authenticated encryption is performed using the algorithm specified in “enc” field of the header. This is used during decryption to ensure integrity.

How to Generate a JWE Token?

Generating a JWE token involves the following steps:

  1. Choose a JWE Library: Choose a programming language and library that supports JWE. There are libraries available for various languages, such as Python (`PyJWT`), Java (`javax.crypto`), Node.js (`node-jose`), etc.
  2. Prepare Your Payload: The payload is the data you want to encrypt and include in the JWE token. It can be a JSON object.
  3. Choose Encryption Algorithms: Common algorithms include “RSA-OAEP” for asymmetric encryption and “A256GCM” for symmetric encryption with AES-GCM.
  4. Generate or Obtain Encryption Keys: You will need encryption keys depending on the chosen algorithm. For asymmetric encryption, you’ll need a public key; for symmetric encryption, you’ll need a shared secret key.
  5. Create the JWE Token: Use your JWE library to create the JWE token. Here’s a Python example using the `PyJWT` library:
    import jwt
    
    # Sample payload data you want to include in the JWE token
    # Use the "PrivateClaims" or "SecureCustomData" key to securely pass additional 
    # data to the Platform
    payload = {
        "sub": "1234567890",
        "name": "John Doe",
        "iat": 1516239022,
        "privateClaims": {
          "accountId": "123412512512556",
          "fusionSid": "12125125125",
          "siteId": "124125125125"
        }
    }
    # Sample encryption key (the shared secret key used for encryption)
    secret_key = "MySecretKey123"
    # Create the JWE token
    jwe_token = jwt.encode(
        payload,
        secret_key,
        algorithm='HS256',  # Algorithm for signature (HMAC SHA-256)
        headers={"alg": "A256GCM"}  # Algorithm for encryption (AES-GCM)
    )
    print("JWE Token:", jwe_token)
    

You can now use the generated JWE token in your application.

Find the Kore.ai JWE Public Key

The Kore.ai Public Key is displayed in JWK format when you enable the JWE option while creating an SDK app. You can use this in your client library to generate JWE.

Verify and Decrypt the JWE

Let’s see an example of how you can verify and decrypt the JWE, assuming you have a JWE token (containing the payload that was encrypted using a private key), and have access to the corresponding JWE public key. The example below is in Python using the ‘PyJWT’ library; your implementation may vary depending on the language and the library you’re using.

  1. Import Libraries: Ensure you have the necessary libraries installed. In this example, you need `PyJWT` for handling JWTs and JWEs.
  2. Load the Public Key: Load the JWE public key in the form of a JSON Web Key (JWK); for example, the Kore.ai JWE Public Key as shown in the previous section.
  3. Decode and Verify: Use the public key to verify and decrypt the JWE.
  4. Putting it all together: Here’s a Python example using the `PyJWT` library:
    import jwt
    
    # Sample JWE token
    jwe_token = "eyJhbGciOiJSUzI1NiIs...JWE Ciphertext and other components...UkSIsIm4iOiJqYW1lc3RpY3Nl..."
    
    # Sample JWE public key (in JWK format)
    jwe_public_key = {
          "e": "AQAB",                 
          "kid": "de668337-....-....-....-5778944f9630",
          "kty": "RSA",
          "n": "rdqXc48aW...uNMSdIgn"
    }
    
    try:
        decoded_payload = jwt.decode(
            jwe_token,
            jwe_public_key,
            algorithms=['RS256'],  # Algorithm used for signature verification
            options={"verify_signature": True, "decrypt": True}
        )
        print("Decoded Payload:", decoded_payload)
    except jwt.ExpiredSignatureError:
        print("JWE Signature has expired.")
    except jwt.DecodeError:
        print("Invalid JWE Signature or Decryption failed.")
    

In this example code:

  • ‘jwe_token` is the JWE that you want to verify and decrypt.
  • The `jwt.decode` function is used to decode and verify the JWE.
  • The public key is used as the key for signature verification and decryption.
  • The `”verify_signature”: True` option indicates that the library should verify the signature.
  • The `”decrypt”: True` option tells the library to attempt decryption of the JWE.
  • The `algorithms` parameter specifies the algorithm used for signature verification that should match the algorithm used when creating the JWE.

If the JWE token is valid and the signature can be verified, the payload will be successfully decoded and printed.

For more information about JWE, refer to https://tools.ietf.org/html/rfc7516.

メニュー