Offline Token Delegation for Intermittent IoT Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Networked computing devices, such as IoT devices, often face authentication and authorization challenges in environments with limited or unreliable network connectivity, preventing them from accessing necessary computing services.
Innovation Solution
A local computing device, such as an IoT device, is delegated authority to provide offline authentication and authorization services by storing access and refresh tokens, allowing it to grant or deny access to other devices based on predefined time periods and current network availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If networked computing devices rely on centralized authentication servers for access control, then security and authorization management are improved, but system reliability deteriorates when network connectivity is limited or unavailable
Solution Approach 1:
The authentication system is segmented into multiple components: a centralized authorization server that issues tokens, and distributed client devices that store and validate these tokens locally. This segmentation allows authentication to continue offline while maintaining centralized security policy enforcement, resolving the contradiction between reliability during network outages and system complexity.
Solution Approach 2:
Authentication credentials (access tokens and refresh tokens) are obtained in advance when network connectivity is available. These tokens are stored locally in secure storage, enabling the device to perform authentication operations offline without real-time server connectivity, thus improving reliability while keeping the system architecture manageable.
2Speed
If access tokens are stored locally for offline authentication, then authentication speed and offline access are improved, but security risks increase due to potential token compromise
Solution Approach 1:
The authentication system uses a nested token structure where an access token (providing immediate access) is paired with a refresh token (enabling token renewal). The access token can be quickly validated for immediate authentication speed, while the refresh token provides a mechanism to revoke and renew access tokens, thereby managing security risks without sacrificing authentication performance.
Solution Approach 2:
The system implements dynamic token management where access tokens have limited lifetimes and can be refreshed. This dynamic approach allows fast authentication during the token's valid period while providing security through automatic expiration and renewal capabilities, balancing speed and security requirements.
Data Source
AI summary
A method includes receiving, by a first computing device, a first message from an authorization server over a first network. The first message includes an access token for a computing service, including a permission value defining an access time period, and a refresh token defining a refresh time period. The method further includes storing the access token, the refresh token, and the permission value in a memory of the first computing device. The method further includes receiving, by the first computing device over a second network, a second message including a request for the access token from the second computing device and selectively providing the access token to the second computing device based on the stored access token, the stored refresh token, and the stored permission value.