Persistent Key Access for Restricted Resource Collections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data access management systems require extensive administrative tasks for controlling access to user data, especially when multiple users need to access multiple files, leading to complexity and inefficiency in managing access permissions.
Innovation Solution
The implementation of a method using authorization tokens that persist access privileges, allowing users to grant access to specific or multiple users by generating and managing these tokens, which are associated with user identifiers and can be revoked, simplifying the administrative process and enhancing user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control methods are used with multiple users and files, then access control is provided, but administrative tasks are multiplied and become complex
Solution Approach 1:
The patent introduces an intermediary mechanism (persistent key system) between the user and the access control system. Instead of directly managing individual user permissions for each file, the system uses persistent keys that represent pre-established trust relationships. This intermediary layer simplifies the administrative burden by allowing users to grant access through key distribution rather than configuring detailed permission sets for each user-file pair.
Solution Approach 2:
The persistent key serves multiple functions: it acts as an authentication credential, an authorization token, and a representation of trust relationship. A single persistent key can be used across multiple files and sessions, eliminating the need for separate permission configurations for each access scenario. This multi-functionality reduces the complexity of access control management while maintaining reliable access restrictions.
2Reliability
If traditional access control methods are used with multiple users and files, then access control is provided, but administrative effort increases
Solution Approach 1:
The system performs preliminary action by establishing persistent keys in advance that encode trust relationships and access permissions. These persistent keys are generated and distributed before actual file access occurs, allowing users to gain immediate access without requiring real-time administrative intervention. The administrative work of setting up access control is done once during key generation, rather than repeatedly for each access request.
Solution Approach 2:
The persistent key system enables self-service access control where users can independently manage their own access credentials. Users generate and distribute their own persistent keys to authorized parties, eliminating the need for administrators to manually configure and update permission settings for each user. This self-service mechanism significantly reduces the time administrators spend on access control tasks while maintaining reliable access management.
3Ease of operation
If persistent access is granted to multiple users, then user experience is improved, but control over access becomes more difficult to manage
Solution Approach 1:
The patent segments access control into distinct persistent keys, each representing a specific trust relationship or access scope. Instead of managing a single comprehensive permission set that becomes complex as more users are added, the system divides access control into multiple independent persistent keys. Each key can be independently managed, revoked, or modified without affecting other access relationships, making it easier to control access even when granted to multiple users.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method includes receiving a first request from a first user device to access a first resource that includes data for a second user account for which access to the data is restricted to authorized users, the first request including an authorization token and associated with a first user identifier that identifies a first user; determining that the first user identifier does not identify an authorized user and in response: determining that the first user identifier identifies an authorized user based on the authorization token, and provide the first resource to the first user device; receiving a second request for access to data to the second user account, the second request associated with the first user identifier; and based on the first user identifier being determined to identify authorized user, providing access to the data to the second user account in response to the second request.