Extended OAuth Architecture for Differential Data Sensitivity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The OAuth 2.0 specification does not effectively handle scopes with data attributes of differing sensitivity levels, requiring explicit end-user consent for all requested scopes and assuming all scopes are of similar sensitivity, which is inefficient and not scalable.
Innovation Solution
An extended OAuth architecture that assigns sensitivity levels to data attributes, such as public, private, or a combination thereof, allowing for differential consent requirements, where public data does not require owner consent and private data does, with an authorization device generating authorization codes accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If explicit end-user consent is required for all requested scopes, then security and user control are improved, but user experience and efficiency deteriorate due to unnecessary consent requests for public data
Solution Approach 1:
The patent applies local quality by differentiating consent requirements based on the sensitivity level of individual data attributes within scopes. Public data attributes do not require user consent, while private data attributes require explicit consent. This localized differentiation resolves the contradiction by maintaining security for sensitive data while improving user experience for public data.
2Device complexity
If all scopes are treated as having similar sensitivity, then system complexity is reduced, but adaptability to different data sensitivity levels deteriorates
Solution Approach 1:
The patent applies parameter changes by introducing sensitivity levels as a variable parameter that characterizes different scopes. Scopes are categorized based on their sensitivity (e.g., public, private), and this parameter drives different authorization behaviors. This resolves the contradiction by enabling the system to adapt to varying sensitivity levels while maintaining manageable complexity through structured categorization.
3Reliability
If consent is required for all scopes including public data, then security coverage is improved, but productivity deteriorates due to unnecessary authorization steps
Solution Approach 1:
The patent applies the extraction principle by separating public data attributes from private data attributes based on their sensitivity levels. Public data attributes are extracted from the consent requirement, allowing them to be accessed without user authorization. This resolves the contradiction by maintaining security coverage for private data while eliminating unnecessary authorization steps for public data, thereby improving productivity.
Data Source
AI summary
Method, device, and storage medium to receive a request to authorize a release of protected resource data, wherein the request includes one or more indicators that indicate one or more instances of the protected resource data being requested; identify a sensitivity level for each indicator of the protected resource data; determine whether the one or more indicators of the protected resource data require consent from a resource owner of the protected resource data; transmit a request, to a user device associated with the resource owner, for consent from the resource owner in response to a determination that at least one of the one or more indicators require consent from the resource owner; generate an authorization code in response to receiving consent from the resource owner; and transmit, to the sending device of the request, the authorization code.