Security Module Authorization Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems require numerous authorization keys to implement various functionalities, leading to inefficiencies and potential security vulnerabilities.
Innovation Solution
A method utilizing a security module to sign a provision request with an authorization key, which is validated by an access manager and used to retrieve a functionality container from a repository, ensuring secure and efficient access to multiple functionalities using a limited number of keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If multiple authorization keys are stored for different functionalities, then access control for each functionality is simplified, but security risks and system complexity increase
Solution Approach 1:
The patent implements a universal authorization key that can be used across multiple functionalities. Instead of storing separate authorization keys for each functionality, the system uses a single authorization key in the security module that can authenticate access to various functionalities through an access manager that manages functionality-specific access rights.
Solution Approach 2:
The patent introduces an access manager as an intermediary component between the security module and the functionalities. The access manager receives authentication requests using the authorization key, validates them, and grants access to specific functionalities without requiring the security module to store multiple functionality-specific keys.
2Adaptability or versatility
If multiple authorization keys are stored for different functionalities, then each functionality can be independently authorized, but the number of keys to manage increases
Solution Approach 1:
The system employs a single authorization key that serves multiple functionalities through the access manager. The access manager maintains functionality-specific access control lists that map the universal authorization key to permitted functionalities, eliminating the need to store and manage multiple separate authorization keys.
Solution Approach 2:
The patent extracts the functionality-specific authorization logic from the security module and places it in the access manager. The security module only needs to store the single authorization key, while the access manager handles the complex logic of determining which functionalities are accessible with that key.
3Reliability
If numerous authorization keys are used, then fine-grained access control is achieved, but computational overhead and processing time increase
Solution Approach 1:
The patent segments the authentication process into two distinct phases: a fast authentication phase using the single authorization key in the security module, and a subsequent access rights verification phase handled by the access manager. This segmentation allows the time-critical authentication to be performed quickly with minimal computational overhead.
Solution Approach 2:
The system performs preliminary authentication using the single authorization key before accessing functionality-specific access control lists. This preliminary action filters out unauthorized access attempts early in the process, avoiding the need to perform complex checks for multiple potential authorization keys.
Data Source
AI summary
A method for providing a computer-implemented functionality in a computing system having at least one computing unit and one security module. The method includes signing, by the security module, a provision request specifying a requested functionality, using an authorization key stored by the security module; sending the signed provision request to an access manager; checking, by the access manager, the authenticity of the signed provision request; if the check is successful, sending, by the access manager, an access key for the requested functionality to the computing system; sending a container request for the requested functionality to a repository that stores a functionality container with the requested functionality; and, if the validity of the access key is confirmed, implementing, by the at least one computing unit, the functionality using the functionality container in the computing system.