Apparatus Management System Guest User Directory Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for managing access to apparatuses within an organization struggle to efficiently differentiate and grant utilization authority to both registered and unregistered users, particularly guests, while maintaining security and adhering to varying utilization rules.
Innovation Solution
A system that employs a directory service to classify users as intra-company or outside-company guests, issuing operation IDs with specific utilization authorities, and allows authorized users to approve additional access, using a combination of user authentication, directory service inquiries, and temporal utilization management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the system uses a single authentication process for all users, then the system is simpler to manage, but it cannot differentiate utilization authority between registered users and guest users
Solution Approach 1:
The authentication process is segmented into two distinct paths: a first authentication process for registered users that checks credentials against the system's user database, and a second authentication process for guest users that verifies inclusion in the directory service. This segmentation allows the system to handle different user types with appropriate verification methods while maintaining a unified authentication interface.
Solution Approach 2:
The system dynamically selects which authentication process to execute based on the user's classification (registered or guest). The authentication mechanism adapts its behavior in real-time depending on the user type, enabling flexible authority assignment without requiring separate authentication systems for each user category.
2Device complexity
If the system grants the same utilization authority to all authenticated users, then access control is simpler, but organizational policies cannot be enforced for different user types
Solution Approach 1:
The system assigns different utilization authorities to different user categories: registered users receive authority based on their individual user profiles and roles within the organization, while guest users receive authority based on their directory service classification (intra-company or outside-company). This localized quality approach ensures that each user type receives appropriate access rights tailored to their specific needs and security requirements.
3Reliability
If the system performs detailed directory service inquiries for every guest user, then security is enhanced through proper classification, but processing time increases
Solution Approach 1:
The system performs a focused directory service inquiry that checks only the essential attribute (whether the guest user's identification information is registered in the directory service) rather than retrieving complete user profiles. This partial action approach provides sufficient security verification for guest users while minimizing the time and computational resources required for authentication.
Data Source
AI summary
A non-transitory computer readable medium storing a program causing a computer to execute a process: the process comprising: performing a first utilization permission process for an authorized user; and performing a second utilization permission process for a guest user, the second utilization permission process comprising: acquiring user identification information input by the guest user; inquiring, of a directory service that retains information of a member of an organization, whether the user identification information acquired by the acquiring is registered; and permitting the guest user who inputs the user identification information to use the system within a range of a utilization authority, which is different between a case where a response indicating that the user identification information is registered is received and a case where a response indicating that the user identification information is not registered is received, in response to the inquiry.