Mobile Device Authentication via Segmented Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security protocols for mobile devices in secured computing environments lack fine-grained control over access limits and device-specific constraints, leading to potential security vulnerabilities.
Innovation Solution
A system that includes an authorization station generating authentication keys and identifiers for mobile devices, with rules engines to manage access permissions and revoke access based on location, activity, and other criteria, using a combination of software and hardware to enforce secure communication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If broad access constraints are provided using a secured protocol, then security coverage is improved, but fine-grained control over specific access limits is lost
Solution Approach 1:
The patent segments access control into multiple layers: device-level authentication (mobile device identifier), user-level authorization (user credentials), and resource-level permissions (specific data access rights). This segmentation enables both broad security coverage and fine-grained control by applying different authorization rules at different hierarchical levels.
Solution Approach 2:
The system applies different authorization constraints to different devices and users based on their specific characteristics. Each mobile device receives customized access permissions tailored to the user's role and the specific resources they need, rather than applying uniform broad constraints to all devices.
2Measurement precision
If device-specific constraints are implemented, then access precision is improved, but system complexity increases
Solution Approach 1:
The system performs preliminary authentication and authorization actions before granting access. Mobile devices are pre-configured with device identifiers and authentication credentials, and authorization rules are pre-established based on user roles and resource requirements. This preliminary setup enables precise access control without adding complexity to the actual access operations.
Solution Approach 2:
The patent introduces an intermediary authorization server that mediates between mobile devices and secured computing environment resources. This intermediary handles the complex authentication and authorization logic, device identifier verification, and permission enforcement, thereby isolating system complexity from both the devices and the secured environment.
3Reliability
If strict access management is enforced, then security integrity is improved, but ease of operation deteriorates
Solution Approach 1:
The system implements self-service authentication where mobile devices automatically present their device identifiers and authentication credentials without requiring manual intervention. The authorization server automatically verifies credentials and enforces access permissions, reducing operational complexity while maintaining strict security enforcement.
Solution Approach 2:
Authentication credentials and device identifiers are pre-configured in mobile devices before they need to access the secured environment. This preliminary configuration enables automatic authentication and streamlined access operations while maintaining strict security verification.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
One aspect of the invention is a system for mobile device authentication. The system includes a public-facing server configured to interface with a mobile device. The system also includes a secure server configured to interface with the public-facing server and an authorization station. The authorization station includes processing circuitry configured to establish authorization limits for the mobile device and generate an authentication key associated with the authorization limits. The processing circuitry is further configured to provide the authentication key and an identifier of the mobile device to the secure server, and generate an authorization code including an encoded version of the authentication key and an address of the public-facing server. The processing circuitry is also configured to provide the authorization code to the mobile device to establish authentication for the mobile device to receive data from a control system network as constrained by the authorization limits.