Authentication Server Token Location Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems for mobile devices lack efficient control over access to network services based on device location, leading to inefficiencies in token management and access authorization.
Innovation Solution
Incorporating location data into authentication tokens generated by an authentication server, which are then used by mobile devices to access service servers, allowing for location-based access control without the need for frequent token renewal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication tokens are issued frequently to mobile devices, then access control security is improved, but network efficiency deteriorates due to increased authentication overhead
Solution Approach 1:
The authentication server performs location verification in advance and embeds the location binding information in the token during token issuance. This preliminary action allows the service server to validate tokens without performing complex location checks at each access point, reducing authentication overhead and improving network efficiency while maintaining security
Solution Approach 2:
The patent introduces an authentication server as an intermediary between the mobile device and service server. This intermediary handles the complex location-based authentication logic and token generation, allowing service servers to simply validate tokens without implementing location verification themselves, thus improving overall network efficiency while maintaining strong access control
2Measurement precision
If location-based access control is implemented, then access authorization precision is improved, but device complexity increases due to additional location tracking requirements
Solution Approach 1:
The patent extracts the location verification logic from the mobile device and concentrates it in the authentication server. The mobile device only needs to obtain and present tokens, while the authentication server handles all location-based authorization decisions. This extraction improves access authorization precision without significantly increasing device complexity
Solution Approach 2:
The authentication server automatically obtains location information from trusted sources (such as network location services or GPS data provided by the device) and performs location verification without requiring complex client-side implementation. The system serves itself by centralizing the complex location-based authentication logic on the server side
3Reliability
If tokens are renewed frequently, then authentication data freshness is improved, but loss of time increases due to repeated authentication processes
Solution Approach 1:
The authentication server performs location binding and verification in advance when issuing tokens, embedding location constraints and validity parameters in the token itself. This preliminary action allows tokens to remain valid for longer periods without requiring frequent renewal, reducing authentication time while maintaining data freshness through location-based validation
Solution Approach 2:
The patent implements dynamic token validity periods based on location stability. When a device's location is stable and verified, tokens can have longer validity periods. When location changes are detected, the system can issue new tokens with updated location binding. This dynamic approach optimizes both authentication data freshness and reduces unnecessary authentication time
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An authentication server and methods of generating a token for use by a mobile device to establish authorization for the mobile device to access a service provided by a service server, the method comprising receiving a request for the token from the mobile device, generating the token comprising location data identifying a location for the mobile device and authentication data indicating a level of access that the mobile device is permitted to have to the service provided by the service server, and transmitting the token to the mobile device.