Message-Based Authorization System for Distributed Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Access control systems, particularly for parcel boxes, face challenges in securely authorizing actions across different apparatuses and control units, leading to potential misuse and theft due to the need for physical or electronic keys, which can be cumbersome and insecure.
Innovation Solution
A method and apparatus that enable a first apparatus to obtain and check authorization messages, determining if actions should be performed by itself or a separate control unit, and transmitting requests accordingly, using encryption and digital signatures with asymmetric or symmetric key pairs to ensure secure communication and authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If physical or electronic keys are used for access control, then security against misuse and theft is improved, but ease of operation deteriorates due to the need to carry and manage keys
Solution Approach 1:
The patent replaces physical keys and electronic key storage (tokens, RFID tags) with a communication-based authorization system. The second apparatus communicates authorization requests directly to the first apparatus via message transmission, eliminating the need for physical or electronic key carriers. This substitution maintains security through cryptographic authorization checks while improving ease of operation by removing key management requirements.
2Reliability
If authorization checks are performed for each action request, then security against misuse is improved, but productivity deteriorates due to the additional verification steps
Solution Approach 1:
The patent implements preliminary authorization establishment where the server compiles and transmits authorization information to the first apparatus in advance. The authorization data structure includes pre-validated permissions, action identifiers, and cryptographic signatures. When action requests are made, the first apparatus performs efficient verification against this pre-established authorization rather than conducting full validation checks each time, thus maintaining security while improving processing speed.
3Device complexity
If the first apparatus performs all authorization checks and action decisions, then device complexity is reduced, but adaptability deteriorates because the first apparatus cannot directly cause actions it is not authorized to perform
Solution Approach 1:
The patent introduces a control unit as an intermediary between the first apparatus and the action execution system. The first apparatus maintains its simple authorization-checking function by transmitting authorized action requests to the control unit. The control unit then executes the actions, enabling the system to perform diverse actions across multiple apparatuses while the first apparatus remains relatively simple. This intermediary approach preserves the authorization security model while extending adaptability.
4Reliability
If encryption and digital signatures are implemented for secure communication, then security against unauthorized access is improved, but device complexity increases due to key management requirements
Solution Approach 1:
The patent merges the cryptographic key management functions into a centralized server that generates and distributes asymmetric key pairs to both the first apparatus and second apparatus. This consolidation eliminates the need for each device to independently manage complex key generation, storage, and rotation. The server acts as a trusted authority that simplifies the overall system's cryptographic infrastructure while maintaining strong security through asymmetric encryption and digital signatures for authorization messages.
Data Source
AI summary
A server obtains a message that an authorization for requesting an action via a first apparatus is allocated, wherein the action can be caused by a separate control unit. The server compiles information that identifies the action and that allows the first apparatus to check the authorization. The compiled information is transmitted to a second apparatus. The first apparatus can obtain a message from the second apparatus, which is used to request the causing of the action. The first apparatus checks the authorization for the request on the basis of the obtained message and whether the action is an action that is to be caused by the first apparatus or by the control unit. If it is established that authorization exists and that the action is to be caused by the control unit, then the first apparatus transmits a request to the control unit to cause the action.