Decentralized Authorization Management for IoT Communities
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization management systems for connected objects face scalability issues and complexity in configuration, particularly in decentralized environments, where direct centralization leads to inefficiencies and increased complexity.
Innovation Solution
A method for authorization management in a community of connected objects, where a master object receives requests from requesting objects, verifies certified attributes through an authentication server, and transfers authentication tokens to authorize actions, thereby decentralizing authority and simplifying configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authorization management is centralized through a single authority, then security and control are improved, but system complexity and configuration difficulty increase
Solution Approach 1:
The centralized authorization authority is segmented into multiple distributed authorization servers that can independently operate. Each connected object can be assigned to different authorization servers, distributing the management load and reducing configuration complexity while maintaining security through the same token-based authorization mechanism.
Solution Approach 2:
An authentication server acts as an intermediary between connected objects and authorization servers. It issues authentication tokens that contain authorization information, eliminating the need for direct complex configuration between objects and authorization servers while maintaining secure access control.
2Reliability
If manual configuration of each object's access rights is implemented, then precise access control is achieved, but user operation complexity increases
Solution Approach 1:
Connected objects automatically obtain authentication tokens from the authentication server based on their attributes and policies. The system performs self-service authorization without requiring manual user configuration of each access right, maintaining precise access control through automated token issuance and validation.
Solution Approach 2:
Authorization policies and object attributes are pre-configured in the system. When a connected object needs access, the authentication server automatically retrieves and validates these pre-configured elements to issue appropriate authentication tokens, eliminating the need for users to manually configure access rights at the time of connection.
3Adaptability or versatility
If the number of authorization rules increases to cover more scenarios, then authorization flexibility is improved, but processing time and system overhead increase
Solution Approach 1:
Authorization policies and object attributes are pre-configured and stored in the system. When authorization is needed, the authentication server automatically retrieves and validates these pre-configured elements to issue appropriate authentication tokens, eliminating the need for users to manually configure access rights at the time of connection.
Solution Approach 2:
The authentication server continuously validates authentication tokens against current policies and object attributes. The master object provides feedback by verifying token validity before allowing access, ensuring flexible authorization while maintaining efficient processing through validated token reuse.
4Productivity
If direct communication between all connected objects is allowed, then system scalability is improved, but security risks and communication overhead increase
Solution Approach 1:
The authentication server acts as an intermediary that issues authentication tokens containing authorization information. The master object serves as another intermediary that validates these tokens before allowing access. This layered intermediary approach enables scalable direct communication between connected objects while maintaining security through token-based verification.
Data Source
AI summary
The present invention relates to a method for authorization management in a community (106) of connected objects (103, 104, 105), a master object being determined in said community, the method comprising:receipt, by the master object (102), of a request (110, 123, 130) to carry out an action concerning:the community (106) of connected objects (103, 104, 105) oran internal object of the community (106), the internal object being distinct from the master object (102);receipt (119, 124, 137) of a list of attributes (101), by an authentication server (107) that is distinct from the master object (102);after the list of attributes is verified by the authentication server (107) and a capability of the requesting object (101) is determined based on said list of attributes, receipt (201, 211, 221) by the master object (102) of an authentication token comprising said capability;transfer (202, 212, 222) of said authentication token to said requesting object (101).