Access Control for Isolated Production Systems via Encrypted Key Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control methods for production systems isolated from information systems cannot effectively manage user authentication without duplicating authentication mechanisms, fail to meet robust multi-factor authentication standards, and cannot apply to web applications or Windows workstations without compromising network segregation.
Innovation Solution
A method that uses encrypted private keys stored on the information system, allowing users to decrypt image encryption codes generated by the production system for access, ensuring secure authentication without connecting the production and information systems, utilizing QR-codes, NFC, or Bluetooth for secure key transmission and authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If authentication mechanisms are duplicated in the production system, then access control can be performed independently, but device complexity increases and security is compromised
Solution Approach 1:
The patent extracts the authentication mechanism from the production system and places it in a separate information system. The production system only needs to send authentication requests and receive decisions, while the actual authentication logic, user databases, and security policies reside in the independent information system. This eliminates the need to duplicate complex authentication mechanisms while maintaining independent access control capability.
Solution Approach 2:
The patent introduces an intermediary authentication interface that mediates between the production system and the information system. This interface handles authentication requests, forwards them to the information system, and returns authentication decisions. The intermediary layer simplifies the production system's complexity while enabling it to leverage the information system's robust authentication capabilities.
2Reliability
If the production system is physically isolated from the information system, then network security is improved, but authentication management becomes difficult
Solution Approach 1:
The patent segments the authentication management function from the production system while maintaining physical isolation. The information system handles all authentication management tasks (user registration, credential storage, authentication decisions) separately from the production system. This segmentation allows the production system to remain isolated for security while still benefiting from centralized authentication management through secure interfaces.
Solution Approach 2:
The patent uses an intermediary authentication interface that enables authentication management between the isolated production system and the information system. This interface allows authentication requests to be transmitted securely without requiring permanent physical connections, maintaining network isolation while enabling ease of authentication management.
3Reliability
If strong multi-factor authentication is implemented, then security is enhanced, but ease of operation decreases
Solution Approach 1:
The patent implements a universal authentication interface that supports multiple authentication methods (passwords, tokens, biometrics) through a single standardized mechanism. The information system can enforce multi-factor authentication policies while presenting a consistent, user-friendly interface to end users. This universality allows strong security requirements to be met without significantly complicating the user experience, as all authentication types are handled through the same process flow.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
The invention relates to a method (M) for controlling access to a production system (SIP) of a computer system not connected to an information system (SIC), said method including: A) an initial phase of enrolling a user via a terminal (1) in the production system (SIP), which comprises: a) providing a private encrypted key (Cph) associated with each account of the user in the production system (SIP); b) the terminal (1) transmitting the encrypted private key (Cph) to the information system (SIC) and said system (SIC) registering the encrypted private key (Cph); B) for each request to access the production system (SIP), a phase of authentication by the production system (SIP), which comprises: the terminal (1) of the user recovering a challenge (QRCb) generated by the production system, that only the encrypted key stored in the information system (SIC) makes it possible to solve, said key only being capable of being obtained after the terminal has been authenticated by the information system (SIC).