Cross-Device Access Authorization for Redirect-Only Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web applications face challenges in accessing externally hosted sensitive data due to the reliance on third-party providers that may not support decoupled authorization flows, leading to increased burden on users when redirect authorizations are required.
Innovation Solution
A system and method that utilizes an authorization server and a second device associated with the data owner to facilitate decoupled authorization, converting decoupled requests into redirect requests, enabling authorization on a different device regardless of the third-party provider's support for decoupled flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If redirect authorization flow is used within the same device, then compatibility with third-party providers is improved, but user burden increases
Solution Approach 1:
The patent introduces an authorization server as an intermediary component that mediates between the application server and the data server. This server handles the conversion between decoupled authorization requests and redirect authorization flows, enabling compatibility with third-party providers that only support redirect flows while maintaining the benefits of decoupled authorization on separate devices.
2Ease of operation
If decoupled authorization flow is used on a separate device, then user burden is reduced, but compatibility with third-party providers deteriorates
Solution Approach 1:
The authorization server acts as a mediator that receives decoupled authorization requests from the application server and converts them into redirect authorization flows that are compatible with third-party data servers. This allows the system to maintain decoupled authorization (reducing user burden) while ensuring compatibility with providers that only support redirect flows.
Solution Approach 2:
The system changes the parameters of the authorization request by transforming it from a decoupled flow format to a redirect flow format. The authorization server modifies the request structure, routing information, and flow type to match the capabilities of third-party providers that only support redirect authorization.
3Device complexity
If all authorization is performed on the requesting device, then device complexity is minimized, but ease of operation deteriorates
Solution Approach 1:
The patent segments the authorization process into separate components: the application server handles the initial request, the authorization server manages the flow conversion and coordination, and the user's device handles the biometric authentication. This segmentation allows each component to perform its specialized function, reducing the complexity burden on any single device while improving overall ease of operation through distributed functionality.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
The present invention relates to authorising access to data (132) associated with a user. Aspects of the invention provide a computer-implemented method, computer software, a system and a computing device. The method comprises receiving, at an application server (120) from a first device (110), a request to access the data (132) associated with the user. The data (132) is hosted at a data server (130) external to the application server (120). The application server (120) provides an authorisation request (510) to an authorisation server (140); and the authorisation request is transmitted from the authorisation server (140) to an authorisation application (310) executed on a second device (150) associated with the user. The authorisation application (310) executed on the second device (150) sends, in response to receiving the authorisation request, a redirect authorisation request (520) to a second application (320) executed on the second device (150), the second application (320) being associated with the data server (130). The request is authorised at the second device (150) by the second application (320), in dependence on an authorisation input from the user at the second device (150). In response to the authorisation of the request the second application (320) provides an access token to the application server (120) via the authorisation server (140), the access token being configured to enable access by the application server (120) to the data associated with the user.