On-site Authorization via Cached Certificates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Remote power generation facilities like wind farms face challenges in continuous network access, making conventional authorization methods unreliable for on-site maintenance and compliance with security requirements, especially when network connectivity is intermittent.
Innovation Solution
A method that determines the availability of a network connection to a remote authentication source, authenticating users locally using a trusted certificate if no connection is available, ensuring the certificate's validity for a predetermined period, typically 24 hours or less, to allow secure access to resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authorization methods using central servers are used, then authorization security is maintained, but system availability deteriorates when network connectivity is intermittent
Solution Approach 1:
The system performs preliminary actions by obtaining and caching authorization data from the central server before network connectivity is lost. The local system stores this authorization data locally, enabling it to continue providing authorization services even when disconnected from the central server. This preliminary caching of data resolves the contradiction by ensuring system availability during network outages while maintaining security through pre-validated authorization information.
2Ease of operation
If offline authentication using certificates is implemented, then system availability is maintained during network outages, but authorization security deteriorates due to inability to verify certificate validity
Solution Approach 1:
The system implements a feedback mechanism where the local system periodically checks for updates to authorization data from the central server when connectivity is available. This feedback loop ensures that cached authorization data remains valid and up-to-date, resolving the contradiction by maintaining both system availability during outages and authorization security through continuous validation when the network is accessible.
Solution Approach 2:
The system dynamically adjusts its authorization behavior based on network connectivity status. When connected, it retrieves fresh authorization data from the central server; when disconnected, it transitions to using cached local data. This dynamic adaptation allows the system to maintain availability during outages while preserving security through conditional use of different authorization sources based on real-time network conditions.
3Ease of operation
If certificates with extended validity periods are used, then maintenance access is facilitated, but compliance with security requirements deteriorates due to inability to revoke permissions within required timeframes
Solution Approach 1:
The system segments the authorization data into time-sensitive and persistent components. It divides the authorization validation process into periodic updates from the central server and local caching intervals. This segmentation allows certificates to have extended validity for maintenance access while compliance is maintained through periodic revalidation cycles, resolving the contradiction by separating operational convenience from security compliance requirements.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
A method for authorisation of a user to access a computer system locally at a site is described. The computer system determines whether a network connection to a remote authentication source is available. If the network connection is available, the computer system authenticates the user by interaction with the remote authentication source. If the network connection is not available, the computer system authenticates the user against a credential provided by the user. In this case, the credential will have been provided by or validated by the remote authentication source less than a predetermined time prior to the authenticating step, and the credential is a certificate issued by a certificate authority already trusted by the computer system and valid for a predetermined period of time. A suitable computer system is also described.