Offline Token Access Delegation for Secure Credential Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access delegation methods provide unfettered access to user accounts, risking exposure of sensitive information and unintended modifications, as they require sharing of authentication credentials and lack control over access rights and expiration.
Innovation Solution
A method involving the generation of an offline token on a device without network connectivity, which includes access credentials, access controls, and delegation rights, allowing secure, time-controlled access to a user's account without revealing actual credentials, and can be transmitted via alternative means for use by a delegate device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If authentication credentials are shared for access delegation, then the delegate user can access the account, but security is compromised and sensitive information may be exposed
Solution Approach 1:
The patent segments authentication into multiple independent components: device identifiers, access tokens, and authorization credentials are separated from traditional password-based authentication. The delegate login package contains distinct elements (device ID, token, expiration time) that can be validated independently, allowing the system to verify identity without exposing sensitive authentication credentials.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism where a delegate login package serves as a mediator between the user and the delegate. This package contains encrypted or tokenized credentials that allow the delegate to access the account without directly exposing the user's actual authentication credentials, thus protecting security while enabling delegation.
2Adaptability or versatility
If traditional access delegation is implemented, then users can grant access to delegates, but control over access rights and expiration is lacking
Solution Approach 1:
The patent implements dynamic access control through expiration timestamps and time-limited tokens in the delegate login package. Access rights are not static but change over time, automatically revoking after a specified duration. This allows flexible delegation without complex manual management, as the system dynamically handles access validity based on temporal parameters embedded in the authentication package.
3Adaptability or versatility
If offline device generates authentication tokens, then network connectivity is not required for delegation, but token validation and security verification become more complex
Solution Approach 1:
The patent creates a copy of authentication credentials in the form of a delegate login package that can be generated offline. This package contains replicated authentication data (device identifiers, tokens, expiration information) that mirrors the online authentication structure. The copy can be validated by the server when connectivity is restored, eliminating the need for continuous network connectivity while maintaining security through server-side verification of the copied credentials.
Data Source
AI summary
Described herein are techniques for delegating access using an offline token. The techniques including a method comprising receiving, at a server and from a delegate user device, a delegate login package comprising an offline token and delegate credentials. The offline token is generated at an offline user device and transmitted to the delegate user device for enabling the delegate user device to access access-controlled content associated with the offline user device. The techniques further include validating, by the server, the delegate login package by comparing the delegate credentials with delegate information stored in the offline token. The techniques further including establishing a delegated session between the delegate user device and the access-controlled content stored on the server in response to validating the delegate login package. Furthermore, the delegated session is established according to an access policy, delegation rights, and an expiration parameter stored in the offline token.