Device Authorization Token for Service Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based services typically rely solely on user information for authorization, neglecting device identity and state, which limits their ability to make informed access decisions.
Innovation Solution
Implementing a system where an Enterprise Mobility Management (EMM) server provides a cryptographic token to mobile apps, including device identifiers and state information, which is then used by third-party services to determine access authorization, incorporating device context and security state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authorization is based solely on user information, then the authorization process is simple, but the security and control over service access are insufficient
Solution Approach 1:
The patent segments the authorization process into distinct components: user authentication (handled by traditional auth flows) and device authorization (handled by the device authorization component). This segmentation allows each component to specialize in its function, improving overall security without requiring the entire system to become exponentially more complex.
Solution Approach 2:
The patent introduces a device authorization component as an intermediary between the user authentication process and service access. This intermediary receives authorization requests, evaluates device information against policies, and makes authorization decisions. The intermediary pattern isolates the complexity of device evaluation from the core authentication flows, maintaining simplicity where possible while adding security where needed.
2Measurement precision
If device information is collected and evaluated for authorization, then access control precision is improved, but the system complexity increases
Solution Approach 1:
The patent applies local quality by implementing device authorization evaluation only where needed - specifically in the device authorization component that handles service access requests. Not all system components perform full device evaluation; only the authorization component does. This localized application of complex evaluation logic improves access control precision without requiring every part of the system to be complex.
Solution Approach 2:
The patent creates a simplified representation of device information (device tokens, device profiles) that can be evaluated without requiring the full complexity of the actual device. These copied representations allow the authorization system to make precise decisions based on essential device characteristics without needing to process or store complete device states.
3Reliability
If device state and security information are integrated into authorization decisions, then service access security is enhanced, but the information processing requirements increase
Solution Approach 1:
The patent extracts only the essential device information needed for authorization decisions (device identifiers, security state, compliance status) from the complete device data set. The device authorization component retrieves and evaluates only these specific parameters against authorization policies, rather than processing all available device information. This extraction approach enhances security decision-making while minimizing information processing volume.
4Measurement precision
If comprehensive device evaluation is performed for each service request, then authorization accuracy is improved, but the processing time increases
Solution Approach 1:
The patent performs preliminary device evaluation by pre-establishing device profiles and security states before actual service access requests. The device authorization component maintains cached information about device compliance and security status, so when a service request arrives, the system can make accurate authorization decisions based on pre-evaluated data rather than performing complete device evaluation from scratch for each request.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques to authorize access to a service are disclosed. In various embodiments, a token that includes data comprising or otherwise associated with a device identifier of a device on which an application configured to access a service is installed is provided to the application. A service access authorization request that includes the token is received. The token is used to determine device information associated with the service access authorization request.