Location Token Generation for Spoofing-Resistant Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing location-based authorization processes for electronic resources are unreliable, as they can be bypassed using virtual private networks or remote desktop connections, and may compromise user privacy, leading to user aversion and potential penalties.
Innovation Solution
A method involving a computing device that executes an application to verify a user's location by generating a location token, which is encoded with a user-specific secret key and used to apply a location-based access policy, ensuring secure and accurate location determination without invasive tracking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If network address-based authorization is used to determine geographic location, then the authorization process is simple to implement, but the location determination becomes unreliable and can be bypassed
Solution Approach 1:
The patent introduces a location verification service as an intermediary between the user and the authorization system. This service acts as a trusted mediator that provides verified location information through a challenge-response mechanism, eliminating the need to trust network addresses directly while maintaining system simplicity
Solution Approach 2:
The system performs preliminary location verification by issuing challenges to the user's device before granting access. The device must prove its location through cryptographic proof generated from sensor data, ensuring location authenticity is established in advance rather than relying on potentially spoofed network addresses
2Reliability
If user tracking is implemented to determine location for authorization, then location-based access control can be enforced, but user privacy is compromised and users perceive it as intrusive
Solution Approach 1:
The location verification service serves as an intermediary that handles all location-related operations without requiring the main system to track users. The service receives sensor data locally on the user's device, verifies it through challenges, and only communicates verification results back, keeping the main system unaware of actual user locations
Solution Approach 2:
The user's own device performs the location verification locally by generating cryptographic proofs from its sensor data. The device serves itself by independently verifying its location without external tracking, and only presents the proof when challenged, eliminating continuous monitoring while maintaining verification reliability
3Adaptability or versatility
If location data is shared with authorization systems, then location-based access policies can be enforced, but security risks increase due to potential penalties and data mishandling
Solution Approach 1:
The system uses disposable cryptographic tokens that are generated temporarily for each authorization request and then discarded. These short-lived tokens contain location proof but expire quickly, minimizing the window for potential security breaches while enabling flexible location-based access control
Solution Approach 2:
The location verification service acts as a buffer that handles all interactions between the user and authorization systems. It verifies location proofs and communicates only verification results to the main system, preventing direct exposure of sensitive location data and reducing security risks from data mishandling
Data Source
AI summary
A method at a computing device is described. The method comprises executing an application for verifying a location of a user requesting to access a location-based service, receiving, at the application, information indicating a location of the computing device, and encoding, with the application, at least the location to thereby generate a location token for responding to a challenge for the location token. The method further comprises outputting the location token from the application, the location token configured for use in applying a location-based access policy that controls access by the user to the location-based service.