Recipient-Designated Access Token System for IaaS Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing access token systems fail to prevent illegal distribution of access tokens since the recipient is not designated, leading to unintended authority delegation and illegal access.

Innovation Solution

An access token system that generates and verifies recipient-designated access tokens using secret information, ensuring only the intended recipient can use the token by embedding the inverse element of the secret information in the hash value and using challenge-response verification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If access tokens are generated without recipient designation, then ease of operation is improved, but security deteriorates due to illegal distribution

Engineering Contradiction:

Improveaccess token generationVSAvoidaccess token security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The access token is segmented into multiple components: a first value generated from secret information and a second value representing the target application. This segmentation allows the token to be both easily generated and securely verified, as each component serves a specific function in the authentication process

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary action by generating the access token with embedded recipient identification before any access attempt occurs. The token is pre-configured with the target application information, enabling automatic verification without requiring additional recipient designation steps during access

Inventive Principle:

Principle #10Preliminary action

2Productivity

If access tokens are made valid for unlimited time, then productivity is improved, but security deteriorates due to illegal access

Engineering Contradiction:

Improveaccess efficiencyVSAvoidaccess token security

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The verification apparatus provides feedback by automatically verifying each access token against the registered target application. This feedback mechanism ensures that even with unlimited validity periods, only authorized recipients can successfully access resources, as the system continuously monitors and validates token usage

Inventive Principle:

Principle #23Feedback

3Reliability

If recipient designation is added to access tokens, then security is improved, but device complexity increases

Engineering Contradiction:

Improveaccess token securityVSAvoidaccess token system

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system uses cryptographic copying where the secret information is transformed into a first value that can be embedded in the access token. This copying mechanism allows recipient designation to be included without significantly increasing complexity, as the verification apparatus can regenerate the same first value from the registered secret information

Inventive Principle:

Principle #26Copying

Data Source

PatentUS11895240B2System, apparatus, method and program for preventing illegal distribution of an access token

Publication Date: 2024.02.06 NEC CORP

AI summary

In IaaS (Infrastructure as a Service), when it is desirable to delegate the authority to a user outside a system, a recipient of an access token is designated, thereby preventing illegal distribution of the access token. There is provided an access token system including a generator and a verifier. The generator generates, using secret information of a recipient, a recipient-designated access token for which the recipient is designated, and provides the recipient-designated access token to a user. The verifier verifies that the user who makes access using the recipient-designated access token is the designated recipient.