Local Device Authentication via Token Delegation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Low-power devices, such as smart locks and appliances, face challenges in implementing conventional access-control processes due to their limited processing ability and bandwidth limitations in low-power networks like Bluetooth Low Energy (BLE), making it difficult to manage access control effectively.
Innovation Solution
A computerized process that allows low-power devices to delegate access-control decisions to computing systems maintaining cloud networks, using master tokens to verify identity and generate local tokens for secure access, enabling access control without network connectivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional access-control processes are implemented on low-power devices, then security control capability is improved, but power consumption and processing requirements increase beyond device capabilities
Solution Approach 1:
The patent extracts the complex access-control decision-making function from the low-power resource device and relocates it to a cloud-based server. The resource device only retains lightweight token verification capabilities, while the server handles authentication, authorization, and access-control policy evaluation. This extraction allows the resource device to maintain security functionality without bearing the computational burden of conventional access-control processes.
Solution Approach 2:
The patent introduces cloud-based servers as intermediary components between client devices and resource devices. These servers act as mediators that receive access requests, perform comprehensive authentication and authorization checks, then return simplified token-based credentials to the client device. This intermediary layer handles the computationally intensive security operations, allowing the low-power resource device to participate in secure access control without excessive power consumption.
2Reliability
If comprehensive access control is implemented on low-power devices, then security control capability is improved, but device complexity increases beyond processing abilities
Solution Approach 1:
The patent extracts complex access-control logic including authentication verification, authorization policy evaluation, and access decision-making from the low-power resource device and places it on cloud-based servers. The resource device only implements lightweight token presentation and verification, dramatically reducing its processing complexity while maintaining comprehensive security control through the server's sophisticated access-control mechanisms.
Solution Approach 2:
Cloud-based servers serve as intermediary systems that handle all complex access-control operations. These servers receive raw access requests, perform comprehensive security checks against stored policies and credentials, then return simplified token-based authorization decisions to the resource device. This intermediary approach allows the resource device to benefit from sophisticated security control without implementing the complex processing logic locally.
3Extent of automation
If network connectivity is required for access control verification, then centralized security management is improved, but access reliability deteriorates when network is unavailable
Solution Approach 1:
The patent implements preliminary action by having the cloud server perform complete authentication and authorization verification before granting access. The server validates credentials, checks authorization policies, and pre-determines access decisions before the resource device needs to act. This preliminary verification ensures that even when network connectivity is later lost, the resource device can reliably enforce the pre-determined access decisions using locally cached token verification capabilities.
Solution Approach 2:
The cloud-based server acts as an intermediary that performs comprehensive security verification and then returns self-contained token-based authorization credentials to the resource device. These tokens encapsulate the authorization decisions, allowing the resource device to verify access rights locally without requiring continuous network connectivity to the central security management system. The intermediary server thus enables both centralized security management and offline access reliability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosed embodiments include computerized methods, systems, and devices, including computer programs encoded on a computer storage medium, for device authentication. For example, the resource device may generate and maintain master access tokens, which may be transmitted to a computing system. The computing system may receive, from a device of an owner of the resource device, data granting a client device limited access to the resource device in accordance with various access restrictions. The computing system may generate and provide to the client device a limited version of the master access token that specifies the access restrictions. The client device may present the local access token to the resource device over a direct wireless connection, and the resource device may verify the token and grant the requested access without communication with the computing system.