Hierarchical Data Packet Delegation for Secure Access Rights
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for delegating access rights to secured objects, such as vehicles, do not fully exploit the immateriality of access authorization and face challenges in ensuring that access rights are transferred legally, particularly when offline authorization is needed without central administration device involvement.
Innovation Solution
A method using mobile communication devices to store and transfer access rights through a hierarchical structure of data packets, where each packet includes a unique identifier, access rights, and encryption/decryption secrets, allowing secure delegation of rights between users without involving the central administration device, with encrypted containers ensuring authenticity and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access rights are stored in mobile communication devices and delegated between users, then convenience and usability are improved, but security risks increase due to potential unauthorized copying
Solution Approach 1:
The patent implements nested encryption structures where data packets contain encrypted containers with hierarchical secrets. Each delegated packet embeds references to parent packets and includes encrypted verification data that nests multiple levels of authentication, allowing security checks at each delegation level while maintaining ease of use.
Solution Approach 2:
The system incorporates feedback mechanisms where control devices verify delegated access rights by checking cryptographic signatures and hierarchical references in data packets. This verification feedback ensures that only properly delegated rights are accepted, preventing unauthorized copying while maintaining convenient delegation.
2Reliability
If hierarchical data packets with encryption secrets are used for delegation, then security and verifiability are improved, but device complexity increases
Solution Approach 1:
The patent segments the access rights system into hierarchical data packets, where each packet contains specific delegated rights and references to parent packets. This segmentation allows complex verification to be broken down into manageable cryptographic checks at each level, improving verifiability while keeping individual packet processing relatively simple.
Solution Approach 2:
The system uses cryptographic copying where data packets are replicated with embedded verification data and hierarchical references. Each copy contains sufficient information for verification without requiring the full complexity of the original authorization system, simplifying device processing while maintaining security.
3Adaptability or versatility
If offline delegation without central administration is enabled, then independence and usability are improved, but risk of unlawful acquisition increases
Solution Approach 1:
The patent implements preliminary action by pre-embedding cryptographic verification data and hierarchical references in data packets before delegation occurs. This allows offline verification of authorization legitimacy without requiring real-time connection to central administration, enabling independence while preventing unlawful acquisition through pre-configured security checks.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for delegating access rights to a secured object. First, a first-order data packet is generated in a trusted central management device, which data packet contains a first identifier (ID_A), a first data set (Perm_1) having access rights to a secured device and a first data secret (Key_A) for encryption and signature. A second-order data packet signed by means of the first data secret is created in the first mobile communication device and contains a unique identifier (ID_B), reference data (Ref_A), a second data set (Perm_2) having access rights, a second data secret (Key_B) for encryption and a first data container, which is encrypted by means of the first data secret (Key_A) and which contains the first identifier (ID_A) and the second data secret (Key_B). The signed second-order data packet is transmitted to a second mobile communication device of a second user.