Nested Access Control for Location Information
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack granular control over access to device resources, particularly location information, leading to security and privacy concerns as third-party executable code can access sensitive information without adequate authorization.
Innovation Solution
Implementing a system where access rights to location information on a mobile device can be managed by a second user, allowing for differentiated authorization based on entities, geographic locations, and time-based restrictions, enabling granular control and authorization through a network connection between devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate, layered access policy rules are implemented to control application access to device resources, then access control capability is improved, but device complexity increases
Solution Approach 1:
The patent implements nested access control by creating hierarchical layers of authorization. A parent application (e.g., web browser) can delegate access rights to child applications (e.g., web pages or extensions). This nested structure allows fine-grained control where each layer can independently manage access permissions, resolving the contradiction by organizing complexity in a structured, manageable hierarchy rather than a flat monolithic system.
Solution Approach 2:
The access control system is segmented into distinct components: parent application authorization, child application requests, and granular resource permissions. This segmentation allows the system to manage complex access control policies through modular, independently configurable units, reducing overall system complexity while maintaining comprehensive access control capability.
2Ease of operation
If existing layered access policies are used where browser authorization grants access to all web pages, then ease of operation is improved, but security deteriorates due to lack of granular control
Solution Approach 1:
The patent applies local quality by allowing different authorization levels for different child applications within the same parent application context. Instead of uniform authorization across all web pages, each child application (web page, extension, or plugin) can be granted specific access rights to particular device resources. This enables selective, granular control that maintains ease of parent-level authorization while improving security through child-level restrictions.
Solution Approach 2:
The authorization system is made dynamic by allowing parent applications to selectively grant or revoke access rights to individual child applications based on specific resources and conditions. This dynamic control enables the system to adapt authorization levels locally for each child application rather than applying static blanket permissions, thereby maintaining operational simplicity while enhancing security through flexible, context-aware access control.
Data Source
AI summary
Controlling access to location information by entities hosted by an execution extension environment. After receiving a request from the entity for location information associated with a computing device, access rights of the entity for the requested location information are accessed. A request is sent to another computing device to determine whether to authorize access by the entity to the requested location information. Based on a response from the other computing device, access to the requested location information is enabled.