Offline Access Control via Digital Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems face security vulnerabilities due to the risk of lost or stolen codes, copied electronic keys, and compromised authentication information, especially when they require network connectivity for operation.
Innovation Solution
A system that uses cryptographic key pairs for digitally signing access authorization data, allowing users to verify access requests offline through public-key cryptography, with an access authority generating and verifying signatures using private and public keys, and an access controller reading optical labels like QR codes to authenticate users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication information is sent to a central authority over a network, then access control decisions can be made centrally, but network connectivity is required which may not always be available and increases security risks
Solution Approach 1:
The system performs preliminary authentication by having the access authority digitally sign the user's public key in advance, creating a signed authorization data that can be verified offline. This preliminary action stores the authentication result locally at the access controller, eliminating the need for real-time network connectivity during access decisions.
Solution Approach 2:
The patent introduces digital signatures as an intermediary mechanism between the access authority and access controller. The signed authorization data acts as a trusted intermediary that carries authentication information, allowing the access controller to verify user credentials without direct communication with the access authority, thus resolving the network dependency issue.
2Ease of operation
If traditional codes or electronic keys are used for access control, then the system is easy to operate, but they can be lost, stolen, or copied compromising security
Solution Approach 1:
The system applies asymmetry by using cryptographic key pairs (private key and public key) instead of symmetric authentication methods. The user's private key remains secret while the public key can be freely shared, and the access authority signs data with its private key that can be verified by anyone with its public key. This asymmetric approach provides strong security while maintaining ease of operation.
Solution Approach 2:
The patent uses digital copying through cryptographic signatures. Instead of physical keys that can be copied, the system creates digital signatures that are mathematically unique and verifiable. The signed authorization data can be copied and transmitted, but its authenticity is guaranteed by the digital signature, preventing unauthorized replication.
3Adaptability or versatility
If authentication information is stored centrally, then access management is centralized, but stolen or leaked authentication information compromises security until changed
Solution Approach 1:
The system extracts the critical authentication element (the digital signature verification capability) from the central authority and places it locally at the access controller. The access controller stores the access authority's public key and can independently verify signed authorization data without needing to query the central authority, thus removing the security vulnerability of centralized authentication information storage.
Data Source
AI summary
Disclosed herein is a system for access control. The system comprises an access authority configured to: receive a request associated with a user; determine whether the user is authorised to be granted access; in response to determining that the user is authorised to be granted access, digitally sign access authorisation data comprising a cryptographic key of the user; and send the signed access authorisation data to a user device associated with the user. The system further comprises an access controller configured to: receive from the user device signed authentication data comprising the signed access authorisation data; verify access criteria comprising verifying the signature of the signed access authorisation data, and verifying the signature of the signed authentication data using the cryptographic key of the user; and, in response to verifying the access criteria, grant the access request. Also disclosed herein are methods for access control, methods for sending data, and methods for receiving data.