Offline Access Control via Encrypted Enrollment Data Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems for computer-based resources face challenges in verifying user identity without secure elements on user devices and without connectivity to central databases, particularly in scenarios where network connectivity is unavailable.
Innovation Solution
The system encrypts enrollment information on user devices, allowing control points to decrypt and compare it with verification information using a similarity measure, authorizing access without requiring secure elements or central database connectivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If enrollment information is stored in clear text on user devices or in central databases, then access control can be performed, but security is compromised and connectivity to central databases is required
Solution Approach 1:
The system performs preliminary encryption of enrollment information at the time of enrollment, storing encrypted data on user devices rather than clear text. This preliminary protective action ensures that even if devices are compromised, the stored information remains secure without requiring ongoing connectivity to central databases for verification.
Solution Approach 2:
The system creates encrypted copies of enrollment information that can be stored locally on user devices. These encrypted copies function independently without requiring access to central databases, enabling offline verification while maintaining security through encryption rather than storing sensitive clear text data.
2Object-affected harmful factors
If secure elements are required on user devices for storing verification information, then security is improved, but device complexity and cost increase
Solution Approach 1:
The system replaces expensive, complex secure elements with standard device storage capabilities. By encrypting enrollment information before storage, the system achieves equivalent security without requiring specialized hardware, thereby reducing device complexity and cost while maintaining security protection.
Solution Approach 2:
The system substitutes the mechanical/hardware-based secure element requirement with a software-based encryption solution. Instead of relying on specialized hardware security modules, the system uses cryptographic encryption that can be implemented in software on standard devices, eliminating the need for additional hardware components.
3Reliability
If central databases are required for storing enrollment information, then access verification can be performed, but network connectivity is required which may not be available
Solution Approach 1:
The system segments the centralized database architecture into distributed encrypted copies stored on individual user devices. Each device contains its own encrypted enrollment information, enabling independent verification operations without requiring network connectivity to a central database, thus providing offline operation capability while maintaining verification reliability.
Solution Approach 2:
Encryption acts as an intermediary mechanism that enables secure local storage and verification. The encryption scheme allows the control point to verify user identity using locally stored encrypted data without requiring direct access to central databases, bridging the gap between security requirements and offline operation needs.
4Device complexity
If verification information is transmitted without encryption, then processing is simpler, but security is compromised
Solution Approach 1:
The system applies preliminary encryption to enrollment information before it is stored or transmitted. This advance protective measure ensures that even if data is intercepted or accessed unauthorizedly during transmission or storage, the information remains protected, balancing security requirements with processing feasibility.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Controlling access resource functions. Establishing, by a resource access manager, enrollment information (e) for each of a plurality of users. Encrypting, by the access manager, each received (e) in an authorization data item for the corresponding user. Transmitting, by the access manager, each authorization data item to a corresponding user device. Receiving, by a resource control point, from a user device, a request for access to a function of the resource, the request for access comprising the received authorization data item and verification information (v). Decrypting, by the control point, the received authorization data item to extract (e). Determining, by the control point, a similarity measure between (v) and (e). For a determined similarity measure greater than or equal to a threshold, authorizing, by the control point, the request for access. For a determined similarity measure less than the threshold, denying, by control point, the request for access.