Remote Access Authentication and Authorization Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication methods for remote access to computing services are vulnerable to malware attacks and hacking, as they do not adequately separate authentication and authorization processes, leading to insecure access to remote resources.
Innovation Solution
A system and method that separates authentication and authorization processes, where authentication is followed by a distinct authorization process involving a one-way function and dynamic connection information to establish a secure connection, using QR codes and One-Time-Authorization (OTA) codes to ensure secure access to remote services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional authentication methods are used for remote access, then ease of operation is improved, but security is worsened due to vulnerability to malware attacks and hacking
Solution Approach 1:
The patent divides the authentication process into two separate stages: authentication (verifying identity) and authorization (granting access). This segmentation allows each stage to be handled securely through different mechanisms - authentication uses biometric or multi-factor verification, while authorization uses one-time codes transmitted through secure channels, thereby improving security without significantly complicating user operation
Solution Approach 2:
The patent introduces an intermediary authorization server that mediates between the client device and the remote service. This intermediary receives authenticated requests, generates one-time authorization codes, and manages the authorization process separately from authentication, creating an additional security layer that prevents direct exposure of authentication credentials to remote services
2Device complexity
If authentication and authorization processes are combined, then device complexity is reduced, but security is worsened due to inability to prevent unauthorized access
Solution Approach 1:
The patent implements clear separation of authentication and authorization processes into distinct functional modules. Authentication verifies user identity through secure methods, while authorization independently manages access permissions using one-time codes. This segmentation increases system complexity but provides necessary security controls to prevent unauthorized access
Solution Approach 2:
The patent performs preliminary authentication before authorization, and preliminary establishment of secure communication channels before transmitting authorization codes. This preliminary action ensures that the foundation is secure before proceeding to access granting, allowing complex security measures to be applied in a structured sequence
3Ease of operation
If remote services are activated without protection, then ease of operation is improved, but security is worsened due to being open to hacking
Solution Approach 1:
The patent establishes preliminary protective measures including secure communication channels and authenticated sessions before enabling remote service access. Authorization codes are pre-generated and time-limited, creating inherent protection against hacking attempts while maintaining ease of legitimate access
Solution Approach 2:
The patent uses disposable one-time authorization codes that expire after single use or after a short time period. These short-lived credentials provide strong security protection because even if intercepted, they cannot be reused, while requiring minimal user effort to generate and transmit
Data Source
AI summary
System and method for providing access to remote computing services in an application server are described, where the authentication and authorization processes are separated, excluding service access privileges from the authenticating process and transferring the privileges to the authorization process. A client device and a user are authenticated, and upon successful authentication, the authorization process is performed, including establishing an authorization connection between the client device and the server computer; at the server computer, detecting and verifying the authorization connection; and upon successful verification, allowing access of the client device to the service on the server computer. In one embodiment, upon detecting the authorization connection, a blocking process is created to block access to the service; and, upon successful verification of the authorization connection, the blocking process on the server computer is terminated, prior to the allowing the access of the client device to the service on the server computer.