Chained Authentication Issuance Counter for Service Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Single Sign-On systems lack a method to track and limit the number of times authentication information is chained-issued, potentially allowing unauthorized users to access multiple servers without restriction.
Innovation Solution
A service usage management method that increments and tracks the number of times authentication information is chained-issued, ensuring that each server counts the issuance and limits further access based on a predefined threshold, preventing unauthorized expansion of service access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If chained-issuance of authentication information is permitted without limitation, then users can access multiple servers through single authentication, but the range of servers accessible expands uncontrollably allowing unreliable users to access services
Solution Approach 1:
The patent applies preliminary action by embedding a usage counter and threshold value directly into the authentication information before it is issued. This counter automatically tracks the number of chained-issuance operations, and the threshold is pre-set to limit access. When the counter reaches the threshold, further chained-issuance is automatically blocked, preventing unreliable users from accessing additional servers beyond the permitted scope while still enabling legitimate multi-server access.
2Reliability
If the number of chained-issuance times is limited to prevent unauthorized access, then service security is improved, but there is no existing technique to track or obtain the number of times of chained-issuance
Solution Approach 1:
The patent applies self-service by making the authentication information itself carry the tracking functionality. The usage counter is embedded within the authentication data structure, and each server automatically increments this counter during chained-issuance operations. The system serves its own monitoring needs through this self-contained mechanism, eliminating the requirement for external tracking infrastructure or complex centralized monitoring systems.
Solution Approach 2:
The patent implements feedback by having each server check the current usage counter value against the threshold value before permitting chained-issuance. This creates a closed-loop control system where the authentication information provides real-time feedback on its own usage status. When the threshold is reached, the feedback mechanism automatically blocks further issuance, ensuring security without requiring additional monitoring complexity.
3Reliability
If individual authentication is performed at each server, then each server can verify user credentials independently, but the user burden and server management load increase significantly
Solution Approach 1:
The patent applies universality by creating an authentication information structure that serves multiple functions simultaneously: it acts as a credential for identity verification, a counter for usage tracking, and a threshold for access control. This multi-functional authentication data structure allows a single authentication operation to enable access across multiple servers without requiring separate authentication processes at each server, reducing user burden while maintaining verification reliability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A service usage management method executed by an information processing device, the service usage management method includes receiving, from a terminal device used by a user, a piece of authentication information which authenticates a user's right to use a service provided by a device as an issuing source and includes a number of times of issuing processing for issuing, based on a piece of authentication information, another piece of authentication information and an identifier of the device as the issuing source, generating the authentication information which includes the number of times of addition of adding one to the number of times indicated in the received authentication information and the identifier of the information processing device and authenticates the user's right to use the service provided by the information processing device, and transmitting the generated authentication information to the terminal device.