Role-Based Access Control Using Triple Encryption and Hashed Cache Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication and authorization mechanisms in Internet-hosted environments, particularly in small to medium-sized shared environments, face challenges in providing secure and user-friendly access management, as they often rely on insecure password transmission and inefficient database lookups, leading to performance issues and complexity in multi-tenant settings.
Innovation Solution
A lightweight authentication and authorization mechanism using triple encryption for initial password generation and hashed cache table management on the hosted server, combined with role-based access control and secure cookie persistence, to ensure secure and efficient access for employees, partners, and customers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If basic authentication with password transmission over Internet is used, then authentication can be implemented, but security is compromised due to vulnerable password transmission
Solution Approach 1:
The system performs preliminary actions by encrypting passwords before transmission and using secure hash functions to create digests. The password is hashed with a salt value before being sent over the Internet, and the system pre-configures security parameters including encryption keys and hash algorithms to ensure security from the outset.
Solution Approach 2:
The patent introduces an intermediary mechanism using secure hash functions and salt values between the password and transmission. Instead of sending the plain password directly, the system creates a hashed digest with a salt value as an intermediary representation that maintains security while enabling authentication.
2Ease of manufacture
If text files are used to store authentication information without index, then storage is simple, but lookup performance deteriorates due to time-costly operations
Solution Approach 1:
The authentication information is segmented into structured records with indexed fields. Instead of storing all authentication data in a single unindexed text file, the system divides the data into manageable segments with specific fields (username, password hash, salt value) that can be individually indexed for efficient retrieval.
Solution Approach 2:
The system performs preliminary indexing of authentication records before authentication requests arrive. By pre-organizing the data structure with indexed fields and preparing the lookup paths in advance, the system eliminates the need for time-consuming linear searches during actual authentication operations.
3Device complexity
If HTTP stateless authentication is used, then protocol simplicity is maintained, but authentication performance deteriorates due to repeated verifications
Solution Approach 1:
The system performs preliminary authentication verification and stores the result in a cache data structure before the main authentication process. By pre-checking and caching authentication status, the system avoids repeated full verification operations for subsequent requests, significantly improving performance while maintaining protocol simplicity.
Solution Approach 2:
The patent creates a copy of the authentication verification result and stores it in a cache for future reference. Instead of re-verifying the entire authentication process for each request, the system uses a cached copy of the authentication state, reducing the computational burden and improving response time.
4Adaptability or versatility
If role-based access control with combinatorial inheritance is used, then authorization flexibility is improved, but system complexity increases due to multiple role combinations
Solution Approach 1:
The patent merges multiple role definitions and their associated permissions into a unified combinatorial inheritance framework. By combining roles at different levels (organization level, business unit level, department level) and automatically inheriting permissions, the system reduces the number of separate authorization rules while maintaining flexibility.
Solution Approach 2:
The role-based access control system is designed with universal applicability across multiple tenants and business units. The same role inheritance framework serves different organizations, departments, and permission sets, making the system multi-functional and reducing overall complexity through standardization.
Data Source
AI summary
A method for remote services authentication in an internet hosted environment includes a high level process and functionality for a secure, practical and logically optimized inter-network authentication mechanism by employees, partners and customers of an enterprise into the hosted Internet site. The lightweight authentication and authorization mechanism can be most effectively implemented in Java as part of the application or web server servlet. The method for remote services authentication includes initial secure password establishment, subsequent authentication and authorization, as well as authentication and authorization upon resuming previously run sessions with the hosted server using Internet cookies.