Endpoint Privacy in Cloud Conferencing via Encrypted Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud-based networking environments, there is a challenge in preserving the privacy of endpoints participating in conference calls, as unauthorized parties can infer sensitive information from the identities of participants and the duration/direction of communications, potentially leading to unfair business advantages.
Innovation Solution
The implementation of an authorization server, acting as an intermediary, provides encrypted access tokens that conceal endpoint identities, using decentralized or centralized key distribution methods, ensuring that only authorized parties can access and verify identities within the cloud conferencing server, while media is exchanged without revealing true identities to the cloud conferencing server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cloud-based conferencing is used to enable communication between endpoints, then communication capability is improved, but endpoint privacy is worsened due to exposure of identities and communication metadata
Solution Approach 1:
The patent introduces an authorization server as an intermediary component between endpoints and the cloud conferencing server. This server issues access tokens that contain encrypted endpoint identifiers, allowing the conferencing server to route media without learning the actual endpoint identities. The intermediary thus enables communication functionality while preserving privacy by preventing direct exposure of sensitive information.
2Productivity
If access tokens include endpoint identifiers for routing media, then media delivery is improved, but privacy is worsened as identities become visible to the conferencing server
Solution Approach 1:
The patent changes the parameter structure of access tokens from containing plain text endpoint identifiers to containing encrypted endpoint identifiers. The authorization server encrypts the endpoint identifier using the endpoint's public key before embedding it in the access token. This parameter change allows the conferencing server to read and use the identifier for media routing while the encryption prevents unauthorized parties from learning the actual endpoint identity.
3Ease of operation
If the cloud conferencing server knows endpoint identities for proper routing, then communication functionality is improved, but unauthorized inference of sensitive information is enabled
Solution Approach 1:
The authorization server acts as a mediator that provides the cloud conferencing server with encrypted endpoint identifiers in access tokens. The conferencing server can use these encrypted identifiers to route media correctly without being able to decrypt or infer the actual endpoint identities. This intermediary approach maintains communication functionality while blocking unauthorized inference of sensitive information about endpoints and their communications.
Data Source
AI summary
In one embodiment, a first request may be received from a first endpoint to access a cloud-based conference platform. The first request can include a first access token. Based at least on the first request, a first certificate may be provided to the first endpoint, wherein the first certificate may not include an identity of the first endpoint. A second request may be received from a second endpoint to access the cloud-based conference platform. The second request can include a second access token. Based at least on the second request, a second certificate can be provided to the second endpoint, wherein the second certificate may not include an identity of the second endpoint. Data can be routed within the cloud-based conference platform between the first endpoint and second endpoint based at least upon the first certificate and the second certificate.