Distributed Ledger Device Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems for service accounts are vulnerable to unauthorized access when passwords are compromised, lacking robust mechanisms to securely manage device permissions and user authorizations.
Innovation Solution
A distributed ledger system, such as a blockchain, is employed to manage device permissions and user authorizations, where a primary authority holder generates private ledgers for devices, allowing secure addition and management of secondary authority holders, with records indicating device associations, access grants, and permissions, ensuring secure access to services and features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password-based authentication is used for service accounts, then ease of operation is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The authentication system is segmented into multiple independent components: device identification, distributed ledger verification, and authorization records. Instead of relying on a single password mechanism, the system divides authentication into device-level identification and user-level authorization, where each component validates separately through distributed ledger records, thereby maintaining ease of operation while significantly improving security
Solution Approach 2:
A distributed ledger system is introduced as an intermediary between the user device and the service account. The ledger stores and verifies authorization records that link devices to accounts without exposing sensitive authentication credentials. This intermediary layer enables secure verification of device associations and authorization status while preserving the simplicity of password-based access for authorized users
2Reliability
If distributed ledger verification is implemented for device authorization, then security against unauthorized access is improved, but device complexity increases
Solution Approach 1:
Authorization records are预先 stored in the distributed ledger before actual authentication occurs. Device identifiers and their associations with service accounts are registered in advance on the ledger, creating a pre-established trust framework. When authentication is needed, the system simply verifies against these pre-stored records rather than performing complex real-time computations, thereby enhancing security while minimizing runtime device complexity
Solution Approach 2:
The system uses cryptographic copies of device identifiers and authorization records stored on the distributed ledger. Instead of storing sensitive original credentials on individual devices, the system verifies authentication through cryptographic proofs and hashed copies of device identities on the ledger. This copying approach maintains security through distributed verification while keeping individual device implementations relatively simple
3Reliability
If multiple distributed ledgers are used to store device and user authorization records, then reliability of authorization verification is improved, but system complexity increases
Solution Approach 1:
The authorization system is segmented across multiple specialized distributed ledgers, each responsible for specific types of records: device identification records, user authorization records, and permission records. This segmentation allows each ledger to be optimized for its specific function and enables parallel verification processes, improving overall authorization reliability while managing system complexity through functional separation
Solution Approach 2:
The distributed ledger system implements a universal verification mechanism that can validate multiple types of authorization records across different ledgers through a common cryptographic framework. The same verification protocols and cryptographic primitives are used across all ledgers, allowing the system to handle diverse authorization scenarios with a unified approach, thereby improving reliability without proportionally increasing complexity
Data Source
AI summary
Systems and methods are described for authorizing users and/or devices. An example method may comprise receiving, from a user device, a request to access a function associated with a service account. The request may comprise an identifier of the user device. The example method may comprise determining, based on the identifier, a primary authority holder of the service account. The example method may comprise determining that a first record on a first distributed ledger associated with the primary authority holder indicates that the user device is associated with the primary authority holder. The example method may comprise determining that a second record on a second distributed ledger associated with the user device indicates that the user device is associated with the primary authority holder. The example method may comprise granting, based on the request, the first record, and the second record, the user device access to the function.