Dual-Layer Document Access Control via User-Terminal Binding

The patent segments the access authorization into two independent dimensions: user identity and terminal device. Instead of granting access based solely on user designation, the system requires both the designated user and the specific terminal device to be authorized. This segmentation creates a dual-layer security mechanism where document access rights are divided between user-level permissions and device-level bindings, preventing unauthorized access even if one layer is compromised.

The patent introduces a metadata structure as an intermediary that mediates between the document and the access request. This metadata contains both user identification information and terminal device binding information, acting as a gatekeeper that verifies both dimensions of authorization before permitting document access. The metadata serves as the intermediary validation layer that enforces the dual-authorization requirement.

The patent implements dynamic terminal binding where the association between documents and terminal devices is not fixed but can be flexibly managed. The system allows the designated user to specify which terminal devices are authorized for document access, and these bindings can be updated, added, or removed as needed. This dynamic approach enables the system to adapt to changing device environments while maintaining security through controlled authorization rather than rigid restrictions.

The patent creates a universal access control framework that works across different terminal device types. The metadata structure and authorization mechanism are designed to be device-agnostic, supporting various terminal types (computers, mobile devices, tablets, etc.) as long as they meet the authorization criteria. The system's multi-functionality allows it to handle both strict single-device binding and flexible multi-device authorization scenarios within the same framework.