Cross-Device Access Authorization for Redirect-Only Data Providers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web applications often require access to externally hosted sensitive data, but third-party providers may not support decoupled authorization flows, leading to increased burden on users when authorization is performed on the same device.
Innovation Solution
A system and method that utilizes an authorization server and application on a second device associated with the user to facilitate decoupled authorization, converting decoupled requests into redirect requests, allowing authorization on a different device regardless of the third-party provider's support for decoupled flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If authorization is performed on the same device (redirect authorization flow), then compatibility with third-party providers is maintained, but user burden increases and convenience deteriorates
Solution Approach 1:
The patent introduces an authorization server as an intermediary component that mediates between the application server and the data server. This server receives authorization requests, generates appropriate authorization URLs, and manages the authorization flow, thereby decoupling the authorization process from the user's device and reducing user burden while maintaining compatibility with third-party providers that only support redirect flows.
2Ease of operation
If decoupled authorization flow is implemented, then user convenience is improved and authorization can be performed on separate devices, but compatibility with third-party providers deteriorates since they may not support decoupled flows
Solution Approach 1:
The patent dynamically changes the authorization flow parameters based on the capabilities of the data server. The system detects whether the data server supports decoupled authorization and automatically adjusts the flow type (redirect vs. decoupled) accordingly. This allows the system to achieve decoupled authorization when possible while falling back to redirect authorization for compatibility when needed.
Solution Approach 2:
The authorization system is designed to be dynamic and adaptive, switching between different authorization flow types based on the capabilities of the involved systems. The flow can transition between redirect-based and decoupled modes, making the system flexible enough to work with both modern and legacy third-party providers.
3Device complexity
If redirect authorization flow is used within the same device, then implementation simplicity is maintained, but security is reduced compared to decoupled flows on separate devices
Solution Approach 1:
By introducing the authorization server as an intermediary, the system achieves decoupled authorization where the user can approve requests on a separate device (such as a mobile device with biometric authentication). This separates the sensitive authorization action from the application device, improving security while the authorization server manages the complexity of coordinating between devices.
Data Source
AI summary
The present invention relates to authorising access to data (132) associated with a user. Aspects of the invention provide a computer-implemented method, computer software, a system and a computing device. The method comprises receiving, at an application server (120) from a first device (110), a request to access the data (132) associated with the user. The data (132) is hosted at a data server (130) external to the application server (120). The application server (120) provides an authorisation request (510) to an authorisation server (140); and the authorisation request is transmitted from the authorisation server (140) to an authorisation application (310) executed on a second device (150) associated with the user. The authorisation application (310) executed on the second device (150) sends, in response to receiving the authorisation request, a redirect authorisation request (520) to a second application (320) executed on the second device (150), the second application (320) being associated with the data server (130). The request is authorised at the second device (150) by the second application (320), in dependence on an authorisation input from the user at the second device (150). In response to the authorisation of the request the second application (320) provides an access token to the application server (120) via the authorisation server (140), the access token being configured to enable access by the application server (120) to the data associated with the user.