ID Token Authentication Server Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems for security devices are inefficient due to time-consuming authentication processes and complex management of user authorizations and terminals, often compromising security when attempting to accelerate these processes.
Innovation Solution
A computer-implemented method using an ID token with a terminal and authentication server, where the terminal authenticates via a static private key and session-bound temporary public key, minimizing network communication and reducing latency by storing permanent keys centrally, allowing fast and secure access to attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (password entry, biometric capture, card data exchange) are used, then security can be maintained, but authentication time increases significantly (seconds to minutes)
Solution Approach 1:
The system performs preliminary actions by pre-establishing trust relationships and storing authentication credentials (private keys, certificates) in secure elements before actual access is needed. The FIDO credential is created in advance and stored in the security device, allowing rapid authentication without real-time complex verification
Solution Approach 2:
The invention extracts the heavy cryptographic verification process from the authentication path. Instead of verifying signatures in real-time during authentication, the system extracts and stores verified trust relationships (FIDO credentials) that can be quickly validated, separating the time-consuming key pair generation and certificate verification from the actual authentication flow
2Ease of operation
If decentralized terminal structure is used, then autonomy and security of individual terminals are improved, but management complexity and maintenance overhead increase significantly
Solution Approach 1:
The invention merges the benefits of decentralized security with centralized management by introducing a hybrid architecture. FIDO credentials are stored locally in security devices (decentralized), but the credential verification and access policy management are handled by a centralized access control server, combining local autonomy with centralized control
Solution Approach 2:
The access control server acts as an intermediary that simplifies management of decentralized terminals. Instead of directly managing numerous terminals, the system uses FIDO credentials as intermediaries that encapsulate authentication state, allowing the server to manage access policies without direct terminal control
3Device complexity
If centralized authentication control is implemented, then management of user permissions is simplified, but network latency increases due to extensive communication processes
Solution Approach 1:
The system performs preliminary authentication actions by pre-creating and storing FIDO credentials that contain verified trust relationships. During actual authentication, the terminal presents these pre-verified credentials to the access control server, eliminating the need for real-time cryptographic verification and reducing network communication to simple credential validation
Solution Approach 2:
The invention extracts the time-consuming cryptographic verification process from the network authentication path. Complex signature verification and certificate validation are performed in advance during credential creation, and only the verified FIDO credential needs to be transmitted and validated by the server, separating heavy computation from network communication
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a computer-implemented method for controlling access by a terminal (118) to an attribute (112) stored in an ID token (100), wherein the method comprises authentication of the terminal (118) by the ID token (100) and authentication of the ID token (100) by the terminal (118), wherein authentication of the terminal (118) by the ID token (100) is effected by means of an authentication server (150) that comprises a static private key (160) associated with the terminal (118), and wherein the terminal (118) accesses the attribute (112) only on condition of the successful authentication of the ID token (100) by the terminal (118).