Secure Authorization via Challenge-Response Symbol Encoding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for remote authorization of access to computing devices lack security, particularly in scenarios where technicians need access without connecting to a network, and existing solutions such as shared passwords or databases are insecure and inconsistent with security policies.
Innovation Solution
A method involving a computing device generating a challenge, encoding it into a symbol, and displaying it for capture by a user's device, which then decodes and sends a request to a server for authorization, allowing secure access without requiring network connectivity or costly hardware installations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If shared passwords or databases are used for authorization, then access is granted to technicians, but security is compromised and administrative privileges are misused
Solution Approach 1:
A server acts as an intermediary between the technician's device and the customer's computing device. The server receives the challenge from the customer's device, generates a time-limited access code, and provides it to the technician. This intermediary mechanism eliminates the need for shared passwords or databases, as each authorization request is handled independently through the server, thereby maintaining security while enabling easy access authorization.
2Reliability
If network connection is required for authorization, then secure communication is possible, but access cannot be granted in offline scenarios
Solution Approach 1:
The customer's computing device generates a challenge and encodes it into a symbol (such as a QR code) that can be captured offline by the technician's device. This preliminary encoding of the challenge into a shareable symbol allows the authorization process to continue even when network connection is not available at the moment of access, while still maintaining security through the challenge-response mechanism that will be validated by the server when connection is restored.
3Reliability
If costly hardware is installed for secure access, then security is improved, but deployment cost and complexity increase
Solution Approach 1:
The patent replaces physical hardware security mechanisms with a software-based challenge-response system. Instead of installing specialized hardware tokens or biometric devices, the system uses software applications on existing devices that can generate, encode, capture, and validate authorization codes. This substitution of mechanical/hardware systems with software-based solutions maintains security while eliminating deployment costs associated with hardware installation and reducing system complexity.
4Ease of operation
If customer has administrative privileges for technician access, then access is granted, but security policy is violated and system integrity is compromised
Solution Approach 1:
The authorization code generated by the server is time-limited and single-use, creating a dynamic authorization mechanism. The code expires after a predetermined time period or after a single use, preventing long-term access or reuse. This dynamic approach allows technicians to access the system when needed without granting persistent administrative privileges, thereby maintaining security policy compliance while enabling operational access.
Data Source
AI summary
A method for authorizing access to a first computing device is provided. The method comprises the first computing device forming a challenge, encoding the challenge into a symbol, and displaying the symbol. The first computing device receives a request for access from a user. Access to the first computing device is allowed in response to provision of an access code to the first computing device by the user. The access code is formed by a server in response to capturing the symbol, decoding the symbol into the challenge, forming a request from the challenge, and providing the request to the server. The server forms a decision to allow access by the user to the first computing device.