Dynamic Authority Delegation Token for Secure Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authority delegation protocols, such as OAuth, are limited by their reliance on HTTP, vulnerability to phishing attacks, requirement for multiple round trips, and complexity, making them unsuitable for secure and efficient access to protected resources across various communication networks, including non-web applications.
Innovation Solution
A secure dynamic authority delegation method using a verifiable authorization token with a structured format that includes authentication methods, strength, and a signature computed with a private key, allowing direct and efficient access to protected resources without HTTP redirection and in a single round trip, applicable to both web and non-web applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OAuth protocol is used for authority delegation, then security against credential sharing is improved, but the system becomes vulnerable to phishing attacks and requires multiple round trips
Solution Approach 1:
The patent applies preliminary action by pre-computing and embedding the authorization proof (cryptographic signature) into the delegation token during the token issuance phase. This allows the resource requestor to present a complete, self-contained authorization proof without requiring additional round trips for verification, thus reducing time loss while maintaining security.
Solution Approach 2:
The patent introduces an intermediary authorization token that mediates between the resource owner and resource requestor. This token contains all necessary authorization information and cryptographic proofs, eliminating the need for multiple interactive round trips while preventing phishing attacks through cryptographic verification.
2Reliability
If OAuth protocol is used for authority delegation, then security is improved, but the protocol complexity increases due to multiple delegation proof types and repeated cryptographic signing
Solution Approach 1:
The patent extracts the essential authorization proof from complex repeated cryptographic signing operations and encapsulates it into a single delegation token with one cryptographic signature. This token contains all necessary authorization information, eliminating the need for multiple proof types and reducing protocol complexity while maintaining security.
Solution Approach 2:
The patent changes the parameter representation by using a standardized token format with fixed fields (issuer, subject, resources, actions, expiration) and a single cryptographic signature. This parameter standardization reduces complexity compared to OAuth's multiple proof types while maintaining equivalent security through cryptographic verification.
3Reliability
If OAuth protocol is used for authority delegation, then web resource access is secured, but the protocol is not applicable to non-web applications due to HTTP dependency
Solution Approach 1:
The patent applies universality by designing an authorization token system that is protocol-agnostic and can be applied to any communication network (web, mobile, IoT, etc.). The token structure and verification mechanism are independent of HTTP, allowing the same security framework to serve multiple application domains beyond web applications.
Solution Approach 2:
The patent segments the authorization mechanism from HTTP-specific protocols, creating a standalone token issuance and verification system. This segmentation allows the authorization core to be independently applied to various communication protocols and application types, enhancing adaptability while preserving security.
4Adaptability or versatility
If OAuth protocol is used for authority delegation, then third-party access is enabled, but the protocol requires users to share credentials which exposes information between sources
Solution Approach 1:
The patent uses disposable, short-lived authorization tokens that are generated for specific purposes and expire after use or after a defined period. These tokens replace permanent credentials, enabling third-party access without exposing long-term authentication information. Each token is single-use or limited-use, minimizing information exposure risk while maintaining access versatility.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
In a communication network wherein a first computing device represents a resource owner and a second computing device represents a resource requestor, the resource owner detects an occurrence of an event, wherein the event occurrence represents a request to access one or more resources of the resource owner stored in a resource residence. The resource owner sends an authorization token to the resource requestor in response to the event occurrence, the authorization token serving as a proof of authorization delegated by the resource owner to be presented by the resource requestor to the resource residence so as to permit the resource requestor to access the one or more requested resources stored in the resource residence.