Access Control Verification via Intermediary Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control methods for resources, especially in trust relationships between organizations, face issues with security and efficiency due to the clear transmission of user identity data and excessive network traffic from remote verification processes.
Innovation Solution
A method involving the acquisition and processing of candidate data using encryption keys to verify user access, where first and second data are decrypted using respective keys, and access is granted if a predetermined portion of the processed data is derivable from the second data, enhancing security and reducing network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user identity data is transmitted in clear text for verification, then access control verification can be performed, but security is compromised as malicious users can acquire and misuse this data
Solution Approach 1:
The patent introduces an intermediary verification mechanism where the resource does not directly receive or process clear user identity data. Instead, the home entity acts as an intermediary that verifies user credentials and communicates only verification results back to the resource, preventing direct exposure of sensitive identity information while maintaining verification reliability
Solution Approach 2:
The patent uses a copy-based verification approach where the resource receives a verification token or result from the home entity rather than the original user identity data. This copy contains sufficient information for access control decisions without exposing the actual user identity, thus maintaining security while enabling verification
2Reliability
If remote verification and authorization processes are implemented, then user credentials can be verified, but excessive network traffic is generated
Solution Approach 1:
The patent implements preliminary verification actions where the home entity performs complete credential verification and authorization checks before the user actually accesses the resource. The verification result is then cached or stored, allowing the resource to make access decisions based on pre-verified information without requiring repeated verification communications, thus reducing network traffic while maintaining verification reliability
Solution Approach 2:
The patent extracts the verification process from the resource's operation flow and separates it into a preliminary step handled by the home entity. This extraction allows the resource to receive only essential access decisions rather than engaging in repeated verification communications, reducing network traffic while preserving verification integrity
Data Source
AI summary
A method, comprising: acquiring candidate data in association with a request for accessing a resource, the candidate data comprising first data and second data; processing the first data with a first key in an attempt to effect decryption of the first data, thereby to obtain first processed data; processing the second data with a second key in an attempt to effect decryption of the second data, thereby to obtain second processed data; and granting the request if a pre-determined portion of the first processed data is derivable from the second processed data. The method may further comprise extracting from the first processed data a group identifier and the pre-determined portion of the first processed data, and effecting a comparison of the group identifier to a reference group identifier in order to conclude whether the first data has been successfully decrypted based on an outcome of the comparison.