Application Token Security Model for Portable Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional user-oriented security models are inadequate for portable computing devices, which often feature multiple applications from different providers, as they do not effectively protect one application and its data from other applications running on the system.
Innovation Solution
An application-oriented security model is implemented, where each application is authenticated and assigned a principal security account with associated privileges and group accounts, generating an application token that includes this security information to determine authorized access to resources and secure objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user-oriented security models are used on portable devices with multiple applications from different providers, then user authentication is simplified, but application-to-application security protection is insufficient
Solution Approach 1:
The security model is segmented into two distinct layers: user-oriented security for authentication and application-oriented security for authorization. The user token handles user identity verification, while a separate application token handles application-to-application access control. This segmentation allows each layer to specialize in its function without compromising the other.
Solution Approach 2:
An application token serves as an intermediary between the application and system resources. The token contains the application's security credentials and is used by the security manager to authorize access requests. This intermediary mechanism enables secure application-to-application communication without requiring direct trust between applications.
2Adaptability or versatility
If multiple applications from different providers are allowed on portable devices, then device functionality and versatility are improved, but security risks from untrusted applications increase
Solution Approach 1:
Application authentication and token generation are performed in advance before the application executes any operations. The security manager verifies the application's credentials and issues an application token that encapsulates its authorized privileges. This preliminary security check ensures that only authenticated applications can access system resources, preventing security risks before they materialize.
Solution Approach 2:
The security model changes the authorization parameter from user-based to application-based. Instead of granting broad user permissions, the system issues specific privilege sets to each application through its token. This parameter change enables fine-grained control over what each application can do, allowing versatile functionality while minimizing security risks through restricted access.
3Reliability
If application-oriented security tokens are generated and attached to each application, then application authorization and access control are strengthened, but system complexity increases
Solution Approach 1:
The application token follows the same structural format as the user token, with both containing account information and privilege lists. The security manager uses the same authentication and authorization mechanisms for both user and application tokens. This universal approach allows the system to handle application security using existing user security infrastructure, reducing overall system complexity despite the added functionality.
Data Source
AI summary
The present invention provides an efficient application oriented security model. Prior to execution, an application is authenticated, and security information associated with the application is retrieved. The security information is then used to generate a token that is attached to the application. The security information may include a principle account associated with the application, a list of group accounts, and a corresponding privilege list.