On-Demand Access Authorization via Secondary Device Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems face vulnerabilities in access authorization, particularly due to compromised authentication devices and complex authorization hierarchies, leading to unauthorized access and misconfiguration issues, which can result in significant damage and breaches.
Innovation Solution
Implementing an on-demand authorization system that associates primary user devices with secondary user devices, temporarily reducing access privileges and reinstating them upon verification from the secondary device, using an external authorization server to manage and enforce access controls dynamically.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If strong authentication mechanisms are used to protect access to resources, then security is improved, but the system becomes vulnerable to identity hijacking when the authentication device is compromised
Solution Approach 1:
The patent segments the authentication process into multiple independent components: the authentication device (for initial login) and the authorization device (for privilege confirmation). By dividing the security function into separate devices, the system prevents identity hijacking because compromising one device does not grant full access without the other device's verification.
Solution Approach 2:
The patent introduces an intermediary authorization device that acts as a mediator between the authenticated user and the protected resources. This intermediary verifies the user's identity and confirms authorization requests, preventing direct access even if the authentication device is compromised. The intermediary adds a verification layer that blocks identity hijacking attempts.
2Adaptability or versatility
If complex authorization hierarchies and grouping mechanisms are implemented to manage access rights, then access control capability is improved, but misconfiguration errors increase
Solution Approach 1:
The patent implements self-service authorization where the authorized user themselves confirms the authorization request through their authorization device. This eliminates the need for complex manual configuration and hierarchy management, reducing misconfiguration errors while maintaining versatile access control. The system automatically manages permissions through user-driven confirmation rather than complex pre-configuration.
3Productivity
If authorization privileges are granted to authenticated entities, then access efficiency is improved, but the risk of unauthorized access increases if authentication fails undetected
Solution Approach 1:
The patent implements feedback mechanisms where the authorization device continuously verifies authorization status and provides real-time confirmation or denial of access requests. This feedback loop ensures that even if authentication fails undetected, the authorization layer catches and blocks unauthorized access attempts, maintaining both efficiency and reliability.
Solution Approach 2:
The patent performs preliminary authorization verification before granting access to protected resources. The authorization device pre-validates the user's credentials and authorization level before allowing any resource access. This preliminary check prevents unauthorized access while maintaining efficient access for legitimately authenticated users.
Data Source
AI summary
A method and system for on-demand authorization of access to protected resources are presented. The method comprises associating a primary user device with at least one secondary user device, the primary device having access privileges at a first degree of privilege; changing any access privileges assigned to the primary user device for accessing protected resources to a lesser degree of privilege; and reinstating the access privileges of the primary user device to the first degree of privilege, upon receiving a verification message from the at least one secondary user device.