Device User Key for Third-Party Application Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing resource management systems rely solely on device certificates or ID tokens for access, which are agnostic to the device/user combination, making them vulnerable to fraudulent acts and lacking in security.
Innovation Solution
A trust anchor of a device, a trust anchor for a user, and a public/private key pair are used to register a unique device/user identifier at a Resource Management System (RMS), enabling secure initial and continued access based on unique device/user combinations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If device certificates or ID tokens are used for access, then ease of operation is improved, but security deteriorates due to vulnerability to fraudulent acts
Solution Approach 1:
The patent merges device identity (device certificate) with user identity (ID token) to create a combined device/user identifier. This combination allows the system to uniquely identify both the device and user together, preventing fraudulent access while maintaining ease of operation through automated authentication.
Solution Approach 2:
The patent introduces a resource management system as an intermediary that verifies the combination of device certificate and ID token. This intermediary validates whether the specific device/user combination has proper authorization, adding a security layer without requiring changes to the end-user access process.
2Device complexity
If device certificates alone are used for access, then device complexity is reduced, but measurement precision deteriorates in identifying unique device/user combinations
Solution Approach 1:
The patent combines device certificate data with ID token data to create a unique device/user identifier. This merging allows precise identification of specific device/user combinations without adding complexity to the individual authentication components, as the combination itself provides the unique identification capability.
Data Source
AI summary
A request associated with accessing resources of the second party may be received at a first agent installed on a device for a first party, the being received from a second agent installed on the device for a second party. Based on the request, a signed access request that includes a refresh token previously obtained from a service of the resource management system (RMS) may be sent to the service of the RMS. The signed access request may be signed by a private key of the device. Also, a public key of the device corresponding to the private key may be registered with the service of the RMS. In response to sending the signed access request, a session token associated with accessing the resources of the second through the second agent may be received by the first agent from the service of the RMS.