Location-Based Access Control Using Human Presence Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for accessing data or services based on user location are insecure, as they can be fooled, leading to unauthorized access.
Innovation Solution
A method involving a server that requests second users, identified by predefined device identifiers, to confirm the local presence of the first user, using presence requests and responses to authorize access only if a positive confirmation is received.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If location-based access control is implemented using GPS or sensor data, then access to data or services can be automated and convenient, but the system becomes vulnerable to spoofing and unauthorized access
Solution Approach 1:
The patent introduces second users as intermediaries who act as human mediators to verify the presence of first users. Instead of directly trusting automated location data from GPS or sensors, the system uses second users (who are presumably physically present with the first user) to confirm location authenticity. This intermediary human verification layer prevents spoofing while maintaining automated access control benefits.
Solution Approach 2:
The system implements a feedback mechanism where second users provide verification feedback about the first user's presence. The server receives location data from first users, sends verification requests to second users, and uses their responses to determine whether to grant access. This feedback loop ensures that automated decisions are based on verified information rather than potentially spoofed data.
2Reliability
If manual verification by second users is required, then security against unauthorized access is improved, but the operation becomes more complex and time-consuming
Solution Approach 1:
Second users naturally perform the verification function as part of their presence with the first user, without requiring special training or complex procedures. The system leverages the inherent knowledge that second users have about the first user's location, turning a potential complexity into a simple self-service verification where anyone present can confirm presence.
Solution Approach 2:
The verification system is designed to work with any second user who is present with the first user, regardless of their identity or relationship. The same verification mechanism applies whether the second user is a family member, colleague, or friend, making the system universally applicable and simplifying the verification process by removing the need for different verification methods for different user types.
3Reliability
If multiple second users are involved in verification, then security is strengthened through multiple confirmations, but the time required for access increases
Solution Approach 1:
The system requires verification from at least one second user, but can accept verification from multiple second users if available. It doesn't mandate a fixed number of verifiers, allowing the system to use partial verification (one second user) when sufficient for security, or excessive verification (multiple second users) when available and appropriate, optimizing the balance between security and speed.
Solution Approach 2:
The verification requirement is dynamic rather than static. The system can adjust the number and type of second users required based on the security sensitivity of the requested data or service, the trust level of available second users, and real-time conditions. This dynamic approach allows the system to strengthen verification when needed and reduce it when unnecessary, minimizing access delays.
Data Source
Figure 1
Figure 2
AI summary
A method provides access to data or a service from a first device 12 relating to a first user 11. A set of identifiers relating each to a second device 14 is predefined. Each second device is related to a second user 13. Each second device identifier allows accessing the concerned second device. A server 110 receives 22, from the first device, a request for accessing the data or service from a current location relating to the first user. The server sends 26, to each selected second device, a request to determine whether the first user is locally present. Each selected second device is identified within the second device identifier set and requests 28, from to the second device user, whether the first user is locally present, as a presence request. Each selected second device gets 210, from the second user, a presence response to the presence request and sends 226, to the server, the presence response. The server verifies 228 whether the received presence response includes a predefined positive presence response. If yes, the server authorizes 236 the first device to access the data or service.