Cloud Token Provisioning for Multi-Device Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing token provisioning methods require users to repeat the provisioning process when switching mobile devices and do not allow token sharing across multiple devices, leading to redundant credential requests and inefficient use of computing resources.
Innovation Solution
A method that provisions multiple access tokens, including a device-bound token and a cloud token, based on a single credential request, allowing both tokens to be used for different transaction scenarios without requiring multiple provisioning requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a token is bound to a single mobile device, then the token security is ensured, but the user cannot switch devices without repeating the provisioning process
Solution Approach 1:
The patent segments the token provisioning system into two distinct token types: device-bound tokens stored securely in the mobile device and cloud tokens stored on remote servers. This segmentation allows the user to have device-bound tokens for current device security while simultaneously obtaining cloud tokens that can be used on new devices, eliminating the need to repeat the entire provisioning process when switching devices.
Solution Approach 2:
The patent creates a copy of the credential representation in two different forms: a device-bound token that remains secured on the original device and a cloud token that is stored on remote servers. This copying mechanism enables the user to access their credentials on a new device by retrieving the cloud token, without compromising the security of the original device-bound token.
2Adaptability or versatility
If a separate provisioning request is made for each mobile device, then each device receives its own token, but computing resources are wasted through redundant credential verification
Solution Approach 1:
The patent performs the credential verification and authorization process only once during the initial provisioning request. The authorization entity verifies the credential and generates both device-bound and cloud tokens in a single operation. This preliminary action eliminates the need for repeated credential verification when additional devices are provisioned, significantly reducing computing resource waste while maintaining multi-device support.
Solution Approach 2:
The patent merges the token provisioning process for multiple devices into a single operation. By generating both device-bound tokens and cloud tokens simultaneously in response to one provisioning request, the system achieves multi-device support without requiring separate provisioning requests for each device, thereby improving computing resource efficiency.
3Reliability
If the token is stored only in the mobile device secure element, then hardware security is maximized, but the token cannot be accessed on alternate devices
Solution Approach 1:
The patent segments token storage into two distinct locations with different security characteristics: the mobile device secure element for device-bound tokens and remote servers for cloud tokens. This segmentation allows the system to maximize hardware security for the primary device while simultaneously enabling device flexibility through cloud-stored tokens that can be accessed on alternate devices.
Solution Approach 2:
The patent introduces cloud tokens stored on remote servers as an intermediary that bridges the gap between hardware security and device flexibility. The cloud tokens serve as a mediator that can be retrieved on alternate devices without compromising the security of the original device-bound tokens stored in the secure element, thus achieving both reliability and adaptability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method is disclosed. The method includes receiving, by a token service computer, a token request message, the token request message being originated from a token requestor computer. The method also includes determining, by the token service computer, two or more access tokens based upon a single credential, and then transmitting the two or more access tokens to the token requestor computer in a token response message.