Secure Access Token Sharing for Trusted Users
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches to granting access to protected resources based on access tokens require each trusted user to obtain an authorization grant, even if another user already possesses a valid access token, leading to inefficiencies in sharing access among associated users.
Innovation Solution
A method and system for securely sharing an access token between trusted users, involving generating a list of trusted users, obtaining an access token using an authorization grant, and transmitting a copy of the access token to enable access to a protected resource without requiring the second user to obtain a new authorization grant.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If each trusted user obtains an authorization grant and access token independently, then security and authorization control are maintained, but the process becomes inefficient and time-consuming when multiple users need access
Solution Approach 1:
The system performs preliminary actions by having the first user obtain the authorization grant and access token in advance. The access token is then shared with the second user through secure transmission, eliminating the need for the second user to go through the entire authorization process. This preliminary action by the first user resolves the contradiction by enabling quick access for multiple users while maintaining security controls.
Solution Approach 2:
The system creates a copy of the access token obtained by the first user and transmits it securely to the second user. This copying mechanism allows the second user to access protected resources without repeating the authorization process, thereby improving productivity and reducing the time loss associated with multiple independent authorization requests.
2Productivity
If access tokens are shared among multiple users, then access efficiency is improved, but security risks may increase
Solution Approach 1:
The system introduces an intermediary mechanism through the authorization server that manages token sharing. The server verifies the relationship between users and validates the sharing request before transmitting the access token copy. This intermediary control maintains security reliability while enabling efficient access for multiple trusted users, resolving the contradiction between productivity and reliability.
Solution Approach 2:
The system extracts the access token from the first user's credentials and transmits only the necessary copy to the second user, rather than sharing all authentication information. This extraction approach minimizes security risks by limiting what is shared while still enabling efficient access for multiple users.
3Ease of operation
If the authorization process is simplified for trusted users, then ease of operation is improved, but the complexity of the authorization system increases
Solution Approach 1:
The authorization system is designed with multi-functionality to handle both independent authorization requests and token sharing scenarios. The same authorization server and protocols manage both cases, providing ease of operation for trusted users through simplified token sharing while maintaining a unified system architecture rather than adding separate complex mechanisms.
Data Source
AI summary
Disclosed are techniques of sharing an access token. The techniques comprise generating a list that includes indications of users trusted to access a protected resource. The list indicates a first user and a second user. The technique also comprises inputting, by a first device associated with the first user, an authorization grant. The technique further comprises obtaining, by the first device using the authorization grant, an access token for the protected resource. The access token includes credentials for accessing the protected resource. The technique further comprises providing a copy of the access token to the second user by securely transmitting the copy of the access token to a second device associated with the second user. The copy of the access token enables the second device to access the protected resource.