Bidirectional Authorization System for Mutual Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current unidirectional authorization protocols, such as OAuth, do not allow clients to request authorization for resources on a third-party server, limiting bidirectional access to protected resources.
Innovation Solution
A system and method for bidirectional authorization, where a first and second service provision subsystem acquire temporary credentials, exchange authorization credentials with a user terminal, and obtain access tokens to access resources on both service provision subsystems, enabling mutual access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OAuth protocol is used for authorization, then security is improved by separating client from user credentials, but bidirectional authorization capability deteriorates as only unidirectional access is allowed
Solution Approach 1:
The patent applies inversion by enabling reverse authorization flow where a client can not only request authorization from a resources server but also grant authorization to a third-party client for accessing the client's own resources on another server. This bidirectional capability resolves the limitation of traditional OAuth while maintaining security through token-based authentication.
Solution Approach 2:
The patent implements multi-functionality by designing an authorization system that can operate in multiple modes: traditional unidirectional OAuth flow, and new bidirectional flow where clients can both request and grant authorization. The authorization server and access tokens serve multiple purposes including single-direction and multi-directional resource access control.
2Device complexity
If unidirectional authorization is implemented, then system complexity is reduced, but functionality deteriorates as clients cannot access third-party server resources
Solution Approach 1:
The patent applies preliminary action by having clients pre-register their resources and obtain resource identifiers before needing authorization. The authorization server maintains pre-configured mappings between clients and their resources, enabling quick bidirectional authorization decisions without complex real-time negotiations.
Data Source
AI summary
Disclosed is a bidirectional authorization system, including a first service provision subsystem configured to acquire a first temporary credential of the first service provision subsystem and a second temporary credential of a second service provision subsystem, respectively, send the second and the first temporary credential to the user terminal and the second service provision subsystem, respectively, send the second authorization credential returned by the user terminal to the second service provision subsystem to exchange for a second access token and acquire the second service resources; a second service provision subsystem configured to modify the first temporary credential and send it to the user terminal, send the first authorization credential returned by the user terminal to the first service provision subsystem to exchange for a first access token, and acquire the first service resources; and a user terminal configured to authorize the received second and first temporary credentials, respectively, and return the second and first authorization credentials to the first and second service provision subsystems, respectively. A bidirectional authorization client and a method are also disclosed. The present disclosure can be used to enable clients on both sides to simultaneously access resources of the opposite side.