Authorization Apparatus Batch Access Token Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems impose a significant processing load on authorization servers, data servers, and clients when multiple data pieces are accessed, as each data piece requires separate authorization and access token issuance, leading to increased network load.
Innovation Solution
An authorization apparatus that generates an access token associated with extraction conditions, allowing clients to collectively obtain data pieces satisfying specific filter information by extracting and transmitting a list of identification information to the data server, reducing the need for multiple access token issuances and authentication processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate authorization and access token issuance is performed for each data piece, then access control security is maintained, but processing load on authorization servers and data servers increases significantly
Solution Approach 1:
The patent merges multiple separate authorization processes into a single batch authorization process. The authorization server processes multiple data access requests simultaneously, generating a set of access tokens for multiple data pieces in one operation. This combining approach maintains security verification for each data piece while eliminating the need for repeated separate authorization handshakes, thereby reducing processing load on both authorization and data servers.
Solution Approach 2:
The system performs preliminary batch authorization before actual data access. By pre-generating access tokens for multiple data pieces in a single authorization operation, the system avoids performing the same verification process repeatedly during subsequent data access operations. This preliminary action reduces the processing load during actual data retrieval while maintaining security through pre-validated access tokens.
2Adaptability or versatility
If multiple access tokens are issued for multiple data pieces, then each data piece can be accessed independently, but network load increases due to multiple authentication processes
Solution Approach 1:
The patent combines multiple authentication processes into a single network transaction. Instead of performing separate authentication handshakes for each data piece, the system performs one batch authentication that generates multiple access tokens. This merging of network operations maintains the ability to access each data piece independently while dramatically reducing the total network load by eliminating redundant authentication traffic.
3Measurement precision
If separate authorization is performed for each data piece, then fine-grained access control is achieved, but the number of authentication operations increases
Solution Approach 1:
The system performs preliminary batch authorization that pre-determines access rights for multiple data pieces simultaneously. This preliminary action maintains fine-grained access control by evaluating each data piece's access requirements in advance, while reducing the total number of authentication operations by performing all evaluations in one batch process rather than sequentially during data access.
Data Source
AI summary
An authorization apparatus includes a memory configured to store attribute information associating an identification information of data and information indicating an attribute of the data, the data being stored in a data server, a processor configured to generate an access token in association with an extraction condition to be used for extracting the data to be obtained by a terminal, and a communicator configured to receive a target access token from the data server, wherein when receiving the target access token, the processor is configured to extract identification information of data pieces satisfying the extraction condition associated with the target access token, and generate a list of identification information of the data to be disclosed to the terminal using a target access token, and the communicator transmits the list to the data server.