Proxy Server for Secure Online Account Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Direct credential sharing for online accounts lacks fine-grained permissioning, revocability, and nonrepudiation, making it difficult for organizations to securely share resources across multiple users without risking unauthorized access or misuse.
Innovation Solution
A secure system and method utilizing a proxy server to manage credentials, intercept and store browser cookies, and implement multi-factor authentication, digital signatures, and access control matrices, ensuring that credentials are only accessible through the proxy server and that requests are logged for auditing, thereby providing fine-grained permissioning, revocability, and nonrepudiation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If direct credential sharing is used to allow multiple users to access an online account, then accessibility and ease of operation are improved, but security and control are worsened due to lack of fine-grained permissioning, revocability, and nonrepudiation
Solution Approach 1:
The patent introduces a proxy server as an intermediary between users and the online account. The proxy server holds the actual credentials and manages authentication, while users interact with the proxy server instead of directly using shared credentials. This mediator enables fine-grained permissioning by filtering requests, provides revocability by controlling access through the proxy, and ensures nonrepudiation by logging all actions taken on behalf of the account.
2Adaptability or versatility
If all permissions are granted to shared credentials for full functionality, then versatility and adaptability are improved, but security is worsened due to inability to delegate specific functionalities while withholding others
Solution Approach 1:
The patent implements local quality by applying different permission levels to different users and different functionalities. The proxy server maintains an access control matrix that specifies which users can perform which actions on the online account. This allows specific functionalities to be delegated to individual users while withholding other permissions, enabling fine-grained control over account access and operations.
3Ease of operation
If credentials are shared via email or password management tools for ease of distribution, then ease of operation is improved, but security is worsened due to inability to detect or prevent further sharing with unauthorized users
Solution Approach 1:
The patent implements feedback mechanisms through comprehensive logging and monitoring by the proxy server. All actions taken on the online account are logged and attributed to specific users. The system can detect unusual patterns of access and alert administrators. This feedback loop enables continuous monitoring of credential usage and allows for detection of unauthorized sharing or misuse, providing security while maintaining ease of distribution through the proxy server.
4Reliability
If account credential is changed to revoke access, then security is improved, but ease of operation is worsened due to requiring re-distribution of new credential to all authorized users
Solution Approach 1:
The proxy server as an intermediary eliminates the need to redistribute credentials when revoking access. Administrators can simply update the access control matrix on the proxy server to remove or modify user permissions. The actual credentials remain secure on the proxy server, and users continue to authenticate through the proxy server using their own credentials or tokens. This approach provides immediate revocability without requiring re-distribution of sensitive information to all authorized users.
5Ease of operation
If multiple users share the same credential, then accessibility is improved, but nonrepudiation is worsened due to inability to trace which user took unauthorized actions
Solution Approach 1:
The patent segments the authentication and authorization processes. Instead of sharing a single credential among multiple users, each user has their own authentication credentials that are validated by the proxy server. The proxy server then segments the access control by applying different permission levels to different users through an access control matrix. This segmentation enables tracing of actions to specific users while maintaining accessibility for all authorized users.
Data Source
AI summary
A secure system and method for sharing online accounts includes: a web service; a shared account residing on the web service; a client device requiring access to the shared account; and a proxy server; whereby the client device makes requests to the web service through the proxy server to access the shared account.