Extended Authorization Token for Dynamic User Approval
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization systems lack the ability to dynamically manage user approval for operations on client devices, potentially leading to unauthorized actions without sufficient user consent.
Innovation Solution
A method and system that extend authorization tokens with user approval constraints, requiring client devices to prompt users for approval before executing operations, using a trusted authority and constraint generating engine to generate and transmit extended authorization tokens with user approval methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authorization tokens are used without user approval constraints, then operations can be executed automatically without user intervention, but security is compromised as unauthorized actions may occur without user consent
Solution Approach 1:
The authorization system dynamically adapts its behavior based on operation risk levels. High-risk operations trigger user approval requirements, while low-risk pre-approved operations execute automatically. The system transitions between automated and user-approved modes depending on the specific operation context, resolving the contradiction between security and ease of operation.
Solution Approach 2:
The authorization token structure is extended with new parameters including user approval constraints, approval methods, and policy identifiers. These additional parameters enable the system to encode security requirements directly in the token, allowing automated verification of user approval status while maintaining the existing authorization framework.
2Reliability
If user approval is required for all operations, then security is enhanced by preventing unauthorized actions, but operational efficiency decreases due to constant user intervention
Solution Approach 1:
The authorization system segments operations into different categories: pre-approved operations that execute automatically without user intervention, and high-risk operations that require user approval. This segmentation allows routine operations to maintain high productivity while security-critical operations receive enhanced authorization control.
Solution Approach 2:
User approvals are obtained in advance for high-risk operations before they are executed. The system prompts users to approve operations beforehand, and the authorization token encodes this pre-obtained approval. This allows the operation to proceed automatically once approved, balancing security requirements with operational efficiency.
3Adaptability or versatility
If authorization tokens are extended with user approval constraints, then fine-grained policy control is achieved, but system complexity increases due to additional token processing requirements
Solution Approach 1:
The extended authorization token structure serves multiple functions: it maintains backward compatibility with existing authorization systems, encodes user approval constraints, specifies approval methods, and supports fine-grained policy control. This multi-functional design achieves enhanced policy control without requiring separate systems for each function.
Solution Approach 2:
The authorization server acts as an intermediary that generates extended tokens with user approval constraints and mediates between the operation requester and the client device. This intermediary handles the complexity of token generation and verification, simplifying the overall system architecture while enabling fine-grained policy control.
4Productivity
If pre-approved operations are allowed to bypass user consent, then operational efficiency is maintained for routine tasks, but security risk increases for potentially unauthorized actions
Solution Approach 1:
Different security levels are applied to different operations based on their risk characteristics. Pre-approved operations that are low-risk maintain automatic execution for productivity, while high-risk operations require user approval. The authorization system locally applies appropriate security measures to each operation type, balancing productivity and security.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
A method for managing operations on a client ((116), (118), (120)) is disclosed. The method involves receiving a first request from a first application service provider (ASP) (104) for performing a first operation on the client ((116), (118), (120)), and determining that the first requested operation requires user approval and is not pre-approved. Based on the determination that the first requested operation requires user approval and is not pre-approved, generating an extended authorization token including a user approval method, wherein the user approval method prompts the client ((116), (118), (120)) to seek user approval prior to executing the first requested operation, transmitting the extended authorization token to the client ((116), (118), (120)), receiving a user response to the user approval method, and executing the first requested operation on the client, when the received user response indicates approval of the first requested operation.