Remote Locking Multi-User Device With Authorized User List
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for protecting a lost or stolen multi-user computing device are limited to basic location tracking and memory erasure, failing to effectively prevent unauthorized access by previously authorized users.
Innovation Solution
A method and system that allow a device owner to remotely lock a device by sending a lost device message with a device identifier and an authorized user list, activating a lock screen, and performing two-step authentication to restrict access to only authorized users, using a server to validate credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If basic location tracking and memory erasure are used to protect a lost device, then the device can be located and data can be erased, but unauthorized access by previously authorized users cannot be prevented
Solution Approach 1:
The patent implements dynamic access control by allowing the owner to remotely modify the authorized user list and credentials on the device. The system dynamically updates authentication requirements based on the lost/stolen state, transitioning from normal multi-user access to restricted access mode where only specified users can log in with validated credentials.
Solution Approach 2:
The patent introduces a server as an intermediary between the device and the authentication process. The server validates user credentials and manages the authorized user list remotely, enabling the device to enforce access controls without storing complete authentication logic locally. This intermediary enables complex access control policies to be enforced on the device.
2Reliability
If remote locking with authorized user list is implemented, then access can be restricted to authorized users, but device complexity increases
Solution Approach 1:
The patent extracts the complex authentication logic and authorized user list management from the device itself and places them on the remote server. The device only stores minimal authentication data and credentials, while the server handles the complex tasks of validating user lists, verifying credentials, and managing authentication states. This extraction significantly reduces device complexity.
Solution Approach 2:
The patent makes the authentication system universal by allowing the same server-based validation mechanism to work across multiple devices and user scenarios. The server handles authentication for various user types (primary users, secondary users, service accounts) and device states (normal operation, lost/stolen) through a single unified system, reducing the need for device-specific complex authentication implementations.
3Reliability
If two-step authentication is performed, then security is enhanced, but authentication time increases
Solution Approach 1:
The patent performs preliminary authentication actions by pre-establishing and caching authorized user lists and credentials on the device before the lost/stolen state occurs. When the device enters lost mode, the authorized user list is already in place and can be immediately validated against incoming authentication attempts, eliminating the need for time-consuming real-time verification of user eligibility.
Solution Approach 2:
The patent implements a fast-track authentication process for authorized users by skipping unnecessary verification steps. Once a user's credentials are validated against the pre-stored authorized list and device confirms they are in the lost state, the system rapidly grants access without requiring additional complex verification, effectively rushing through the authentication process for legitimate users.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and devices for restricting access to a computer device may include receiving a lost device message including a device identifier identifying the computer device and an authorized user list including at least one user identification that identifies a user authorized to access the computer device in a lost state. The methods and devices may include logging out existing users on the computer device and invalidate the existing users' credentials on the computer device based at least one receiving the lost device message. The methods and devices may include activating a lock screen on the computer device and setting the computer device to the lost state. The methods and devices may include initiating a log on manager that is configured to recognize the lost state and to restrict access to the computer device to users included in the authorized user list.