Client Server Token Segmentation for Multi-User Permission Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In web applications, multiple users can use the same access token uniformly, leading to an inability to provide access to different resources according to individual user permissions, as the authorization server does not manage user information for authenticated access to the client server.
Innovation Solution
A network system comprising an information processing device, a resource server, a client server, and an authorization server, where the client server manages user authentication and issues verification data, and transmits a first access token to the authorization server, which then issues a token based on tenant information, ensuring that UI components are presented to users according to their permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the authorization server issues a single access token for multiple users, then the web app can be accessed by multiple users, but individual user permissions cannot be enforced when accessing resources
Solution Approach 1:
The patent segments the single access token into multiple user-specific access tokens, each associated with a specific user's authentication information and permission level. The client server generates separate access tokens for each user based on their individual authentication credentials, enabling the system to maintain multi-user access capability while enforcing individual permission-based access control for resource server interactions.
2Device complexity
If the authorization server manages only credential information without user authentication data, then the system structure remains simple, but it cannot provide differentiated access tokens for different users
Solution Approach 1:
The patent introduces the client server as an intermediary between the authorization server and the resource server. The client server receives authentication information from users, generates user-specific access tokens based on this information, and manages the association between users and their corresponding tokens. This intermediary approach enables user-specific access control without requiring the authorization server to directly manage detailed user authentication data, thus maintaining relative system simplicity while achieving differentiated access control.
3Ease of operation
If all users share the same access token, then authentication is simplified, but the system cannot distinguish between different user permissions when accessing resources
Solution Approach 1:
The patent applies local quality by making each access token user-specific rather than uniform across all users. Each access token contains or is associated with specific user identification information and permission levels, allowing the resource server to distinguish between different users and enforce appropriate access controls. This approach maintains ease of authentication through a standardized token mechanism while preserving user permission information through token differentiation.
Data Source
AI summary
A network system comprises an information processing device that uses a web app, a resource server that provides a resource, a client server that accesses the resource server, and an authorization server that permits the client server to access the resource server. The client server issues verification data capable of verifying a user having been authenticated, transmits an issuance request for the first access token to the authorization server according to a start of rendering of a page including a UI component from a web application, and transmits the received first access token. The information processing device transmits a request for resources. The resource server performs verification of the first access token, and transmits the resource to the UI component when the verification of the first access token is successful.