Multi-User-Server Token-Based Authentication

Question

I have heard of token-based authentication, but the problem is that most of it requires trusting the server. What I need is something else.

Alice, with my game, wants to connect to Bob's server, which is designed for my game. Alice can get a token from my official (trusted) server. She also needs to authenticate on Bob's server to prove she is really Alice. But if she sends the token to Bob directly, Bob can exploit her token.

So, what is the way for Alice to show to Bob's server that she is registered as Alice on my server without leaking exploitable data? The connection is unencrypted UDP (if you know how to properly encrypt UDP, than tell me), not https or even http.

Edit: from a comment talking about PKI and an answer mentioning Singning Certificates, I decided I'd use something like RSA and RSA certificates for authentication.

Answer 1

The connection is unencrypted UDP (if you know how to properly encrypt UDP, than tell me)

DTLS (Datagram Transport Layer Protocol). DTLS works very similarly to TLS, but is instead designed to be used in UDP and preserves UDP semantics (unordered, no automatic reordering/resend, low latency). DTLS is widely used to secure UDP, for example in WebRTC, Cisco AnyConnect VPN. The widely used SSL libraries OpenSSL implements DTLS.

Alice, with my game, wants to connect to Bob's server, which is designed for my game. Alice can get a token from my official (trusted) server. She also needs to authenticate on Bob's server to prove she is really Alice. But if she sends the token to Bob directly, Bob can exploit her token.

Alice need to create a client certificate and have the client public key be signed by the trusted server (acting as a CA/certificate authority). Alice then presents this certificate during DTLS handshake to Bob to authenticate itself as Alice. Bob trusts this certificate because the Certificate is signed by the trusted server and Alice was able to prove that it owns the corresponding private key by successfully completing the handshake. Bob cannot use Alice's certificate to impersonate Alice because a Bob doesn't have Alice's private key.