Asynchronous User Permission Model for IoT Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing OAuth 2.0 authorization frameworks require clients to interact with a user-agent or Web browser to obtain third-party permissions, limiting access for applications that cannot support graphical user interfaces or HTTP commands.
Innovation Solution
An asynchronous user permission system that enables applications to obtain third-party permissions for Web services without interacting with a user-agent, using an authorization server and centralized discovery server to provide access tokens through mechanisms like HTTP POST and GET requests, allowing applications to register and poll for permissions independently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If OAuth 2.0 authorization framework is used, then third-party permissions can be obtained, but the application must interact with a user-agent or Web browser which limits access for applications without graphical user interface capabilities
Solution Approach 1:
The patent extracts the user-agent interaction step from the traditional OAuth 2.0 flow. The authorization server directly communicates with the application via HTTP requests, eliminating the requirement for a user-agent or Web browser. This allows applications without graphical interface capabilities to obtain third-party permissions through server-to-server communication.
Solution Approach 2:
The authorization server acts as an intermediary that directly mediates between the application and the resource owner's credentials. Instead of requiring the application to interact with a user-agent, the authorization server handles the authentication and permission granting process through automated HTTP requests and responses, enabling headless applications to participate in the authorization flow.
2Adaptability or versatility
If asynchronous permission model is implemented, then applications without Web browser capabilities can obtain permissions, but the authorization process becomes more complex with multiple polling steps
Solution Approach 1:
The application performs preliminary actions by sending an initial HTTP request to the authorization server with necessary credentials and permissions. The authorization server processes this request and responds with authorization status or required actions, allowing the application to initiate the permission process without waiting for user-agent interaction.
Solution Approach 2:
The implementation uses periodic polling where the application sends repeated HTTP requests to the authorization server at intervals to check the status of permission requests and retrieve authorization tokens. This periodic communication pattern enables asynchronous authorization without requiring continuous user-agent interaction, making the process adaptable to various device types.
Data Source
AI summary
Use of an application to engage services on behalf of a third party is contemplated. The services may be engaged one behalf of the third party with delivery of a third party permission to a Web service, optionally with the third party permission being recognized in the form of an access token (accessToken) provided from the application to the Web service without requiring the application to interact with an user-agent used to obtain the third party permission.