Authorization Apparatus for Context-Aware Authentication Token Issuance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control systems face challenges in securely issuing authentication tokens to devices, as existing methods lack effective control over location, time, and organizational domain restrictions, making them vulnerable to misuse and unauthorized access.
Innovation Solution
An authorization apparatus and method that verifies device identity and context information against stored database data to ensure authentication tokens are issued only within specific locations, time periods, and organizational domains, using authentication parameters like digital signatures and public keys to authenticate and authorize token issuance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If authentication tokens are issued automatically to any device requesting them, then device enrollment is simplified and fast, but security is compromised as tokens can be issued outside authorized locations, times, or domains
Solution Approach 1:
The patent implements dynamic authorization by checking context information (location, time, organizational domain) at the moment of token issuance requests. The authorization apparatus dynamically evaluates whether the current request context matches pre-stored authorized context information in the database, allowing flexible security control without manual intervention while maintaining security constraints.
Solution Approach 2:
The system incorporates feedback mechanisms by comparing real-time request context information against pre-stored authorized context information. The authorization apparatus provides feedback by accepting or rejecting token issuance requests based on whether the context matches authorized parameters, enabling automatic security enforcement without compromising enrollment simplicity.
2Reliability
If manual verification of device identity and context information is performed for each token issuance request, then security control is enhanced, but processing time and operational complexity increase
Solution Approach 1:
The patent applies preliminary action by pre-storing authorized context information (location, time periods, organizational domains) in a database before token issuance requests occur. When a request is received, the authorization apparatus simply compares the request context against pre-stored authorized information, eliminating the need for manual verification while maintaining security control and reducing processing time.
3Reliability
If context information verification is implemented for all token requests, then unauthorized access is prevented, but system complexity and verification overhead increase
Solution Approach 1:
The authorization apparatus implements a universal verification mechanism that handles multiple types of context information (location, time, organizational domain) through a single comparison process. The database stores authorized context information in a standardized format, allowing the system to verify different types of constraints using the same methodology, thereby managing complexity while maintaining comprehensive access control.
Data Source
Figure 1
Figure 2~3
AI summary
A method for an authorized issuing of an authentication token for a device (20), comprising - requesting (12) an authentication token for the device (20) by sending a request message (CSReq) and at least one authentication parameter to an authorization apparatus (30), - verifying (13) authenticity of the request message using the authentication parameter, - verifying (14) authorization for the request by comparing information on the device (20) obtained with the request message in the authorization apparatus with context information for the device (20) stored in a database (38, 39), and - on success of the verification of the authenticity and of the authorization (13, 14), authorizing (15) the issuing of the requested authentication token.