API Manager for Elevator Authorization via Universal Certificate
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern elevator control systems face challenges in verifying the authorization and access rights of users making service requests, particularly when third-party mobile applications are involved, leading to potential malicious or unauthorized commands being sent to elevator systems.
Innovation Solution
An API-manager is implemented in mobile devices to provide a common programming interface and certificate-based authentication, ensuring that only authorized service requests are processed, thereby eliminating the need for third-party applications to have their own certificates and reducing the risk of malicious requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If third-party applications are allowed to control elevator systems, then application versatility is improved, but security and authorization control deteriorate
Solution Approach 1:
The patent introduces an API manager as an intermediary component between third-party applications and the elevator control system. The API manager acts as a mediator that receives service requests from various applications, verifies their authorization using certificates, and only forwards approved requests to the elevator control system. This intermediary layer enables multiple applications to access the elevator system while maintaining centralized security control, thus resolving the contradiction between versatility and authorization control.
2Measurement precision
If each third-party application has its own certificate, then application identification is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal certificate approach where a single certificate is issued to the API manager rather than to each individual third-party application. This universal certificate serves multiple functions: it authenticates the API manager, enables it to verify application identities, and provides centralized trust for all applications. By consolidating certificate management into a single universal certificate held by the API manager, the system achieves reliable application identification without the complexity of managing multiple application-specific certificates.
3Reliability
If access control verification is performed for each service request, then security is improved, but processing time increases
Solution Approach 1:
The patent performs access control verification in advance through the API manager before service requests reach the elevator control system. The API manager pre-authenticates applications using their certificates and maintains an authorization state. When a service request arrives, the API manager quickly checks whether the requesting application is authorized based on pre-verified credentials, rather than performing full access control verification from scratch for each request. This preliminary action ensures security while reducing the processing time for subsequent requests.
Data Source
AI summary
Modern elevators are computer controlled and a computer program sending service requests to an elevator system may be implemented in a mobile device. An API-manager is used in a mobile device for providing a common programming interface for all elevator related applications in the mobile device. The API-manager has a certificate that is used for identifying the person using the mobile device. Thus, it is possible to execute service requests that require authorization or access rights. When the identification is provided at the API-manager third party applications executed in the mobile device do not need own certificates. Furthermore, as the API-manager has a certificate service requests can be trusted also when the mobile application is provided by a third party.