Grant Token Access Coordination for Smart Locks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Service consumers are often bothered with excessive access requests from service providers, requiring manual approval for each access instance, which is inefficient and can lead to security risks due to central storage of access tokens.
Innovation Solution
An access coordination server system that generates a grant token upon service consumer approval, allowing blanket access for service providers within a specified validity time, with credentials generated as needed and stored locally with the service provider to reduce security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual approval is required for each access instance, then security control is improved, but service efficiency deteriorates due to excessive access requests bothering service consumers
Solution Approach 1:
The system performs preliminary action by obtaining advance approval from the service consumer before generating access credentials. The access coordination server requests and stores approval status in advance, then automatically generates credentials when needed without requiring additional manual intervention. This resolves the contradiction by establishing security control beforehand while enabling efficient automatic access during the approved time period.
2Ease of operation
If access tokens are centrally stored, then access management is simplified, but security risks increase due to potential central points of failure
Solution Approach 1:
The system segments the access token into two separate components: a grant token stored securely in the access coordination server and a credential stored locally in the service provider's device. The grant token authorizes credential generation but cannot directly open the lock, while the credential is generated only when needed and remains on the provider's device. This segmentation eliminates the central storage vulnerability while maintaining accessible access management.
3Productivity
If blanket access is granted for a validity period, then service efficiency is improved by reducing approval requests, but security control may deteriorate
Solution Approach 1:
The system changes the parameter of access token validity by implementing time-limited credentials with expiration times. Each credential is generated with a specific validity period, and the access coordination server tracks and enforces these time constraints. This allows blanket access during approved periods while maintaining security control through automatic expiration and revocation capabilities.
Data Source
AI summary
According to a first aspect, it is provided a method for providing access to a lock for provision of a service. The method comprises the steps of: receiving a request for access to the lock; sending a consumer request to a service consumer device, asking whether to grant access to the lock; receiving a positive consumer response from the service consumer device; determining validity time for a grant token; obtaining a grant token for the service provider, the grant token having the determined validity time; providing the grant token to the service provider; deleting the grant token in the access coordination server; receiving an agent request for access to the lock for a specific service provider agent device, the agent request comprising the grant token; obtaining a credential for the service provider agent device; and providing the credential to the service provider agent device.