Distributed Device Authorization via Signed Client Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing device authorization systems for image capture devices, such as those used for live whiteboard sharing, require continuous access to a central authorization server, which is inefficient and insecure, especially when multiple devices need to operate autonomously and securely.
Innovation Solution
A distributed authorization method using client tokens signed with a private key, where connected devices verify the tokens using a public key, allowing secure access without relying on a central server, and includes additional authentication steps to ensure only authorized applications can access the device, constraining them to specific domains and tasks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a central authorization server is used to manage access to connected devices, then security control is improved, but system complexity and dependency on continuous network communication increase
Solution Approach 1:
The authorization system is segmented into distributed components: each connected device receives a portion of the authorization credentials (public key and certificate chain) from the authorization server, enabling local verification instead of requiring continuous centralized control. This segmentation reduces system complexity while maintaining security.
Solution Approach 2:
A signed URL acts as an intermediary mechanism that encapsulates authorization information in a tamper-evident format. The signed URL serves as a mediator between the authorization server and connected devices, allowing devices to verify authorization locally without direct server communication, thus reducing dependency on continuous network access.
2Reliability
If continuous access to a central authorization server is required, then centralized security management is improved, but device autonomy and operational efficiency deteriorate
Solution Approach 1:
Authorization credentials (public keys and certificate chains) are preliminarily distributed to connected devices during device provisioning or initial setup. This preliminary action enables devices to perform autonomous authorization verification without requiring continuous access to the central server, thereby improving device autonomy while maintaining security management.
Solution Approach 2:
Connected devices are empowered to self-verify authorization by using the distributed public keys and certificate chains to validate signed URLs locally. This self-service capability eliminates the need for continuous server communication, improving both device autonomy and operational efficiency while maintaining centralized security policy enforcement.
3Adaptability or versatility
If multiple devices are deployed in large numbers, then system scalability is improved, but the need for continuous server communication and security management complexity increase
Solution Approach 1:
The authorization server distributes copies of public keys and certificate chains to multiple connected devices during provisioning. Each device receives an identical or device-specific copy of the authorization credentials, enabling independent verification without requiring the server to be constantly accessible. This copying mechanism enables scalable deployment of large numbers of devices while reducing security management complexity.
Solution Approach 2:
Each connected device performs self-verification of authorization using its locally stored public keys and certificate chains. This self-service approach eliminates the need for centralized verification of each device's authorization status, enabling scalable deployment of numerous devices without proportionally increasing security management complexity or server communication requirements.
Data Source
AI summary
A method of distributed authorization of one or more client applications to one or more connected devices. The method comprises: receiving at a connected device, from a browser executing a client application, a client token and an access request. The client token has been provided to the client application by a process comprising generating one or more client tokens, one for each of one or more client applications (a client token defines permissions for a client application and a domain hosting the client application); signing the client tokens with a private key of a client token issuer, and distributing the client tokens to the client applications; verifying a signature of the client token using a public key of the client token issuer; determining whether the client token grants the client application permission for the access request and, if permission is granted: replying to the browser with a redirect response including an access token granting permission for the client application to access the connected device and identification of the domain hosting the client application from the client token; and executing the redirect response with the browser to make the access token available to the client application for use by the client application when requesting the connected device to perform a task.