Authentication Device Service-Specific Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control methods for online services often grant broader access rights than necessary, risking unauthorized operations due to hacking, phishing, or 'Man in the middle' attacks, particularly when users need only read or write permissions for specific services.
Innovation Solution
A method and authentication device that transform a personal identification code using a cryptographic function specific to the user and service type, ensuring that only the necessary rights are allocated for the requested service, preventing broader access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the service provider grants broad access rights to users, then users can access multiple services including payments and balance consultation, but the risk of unauthorized operations increases due to hacking, phishing, or man in the middle attacks
Solution Approach 1:
The patent segments access rights into different types corresponding to different service categories. Instead of granting a single broad access right, the system divides rights into multiple specific types (e.g., payment rights, balance consultation rights) and grants only the specific type needed for the requested service. This segmentation allows the system to maintain versatility while reducing the harm from unauthorized operations, as a compromised authentication token would only grant access to a limited service type rather than all services.
Solution Approach 2:
The patent applies local quality by making access rights specific to particular service types rather than uniformly broad. Each authentication token is configured with a specific access right type that matches the service category being accessed. This ensures that even if authentication is compromised, the attacker can only perform operations within the specific service type scope, not across all services. The quality of access rights is localized to the specific service context.
2Ease of operation
If the service provider uses a single authentication method for all services, then the authentication process is simple, but it cannot prevent hackers from performing operations requiring different permission levels
Solution Approach 1:
The patent introduces dynamics by making the authentication process adaptive to the service type being accessed. The authentication token dynamically carries a specific access right type that corresponds to the service category. When a user requests access to a service, the system verifies both the authentication token and whether its access right type matches the service type. This dynamic approach maintains ease of operation (single token for all services) while improving reliability (service-type-specific access control).
Data Source
Figure 1~2
Figure 3
AI summary
The present invention relates to a method and device for controlling access to a specific type of service from among a plurality of service types offered by a service provider. The method comprises the steps of entering a user's authentication device with a personal identification code specific to that user, this personal identification code being identical for at least two distinct types of services offered by the service provider; and of the user indicating the specific type of service to which access is requested, this indication being made in the authentication device.This method is characterized in that it further comprises the steps of transforming the personal identification code within the authentication device, in a manner dependent on at least one cryptographic function specific to the user and the specific type of service required, this cryptographic function being stored in the authentication device; transmitting the result of the transformation of the personal identification code to the service provider; authenticating the user by the service provider, using the transmitted result of the transformation; and granting or denying access to the specific type of service required by the service provider, based on the authentication result. The device is configured to implement this method.