Cross-Domain Sensor Insight Sharing With Gateway Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed systems, particularly in vehicles with multiple computing nodes and sensors, there is a challenge in securely sharing insights generated by synthetic sensors across domains with varying security protocols, where each node may have different manufacturers and operating systems, and ensuring authorized access to these insights is difficult, especially in disconnected modes.
Innovation Solution
A method and system for securely sharing insights involves registering applications with an anchor domain, using signed messages and tokens, synchronizing permissions tables, and employing gateways or bridges to manage access and ensure authorized communication across domains, leveraging cryptographic keys and permissions management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If direct sharing of sensor insights is implemented across domains with varying security protocols, then information sharing efficiency is improved, but security and authorization control deteriorate
Solution Approach 1:
The patent introduces a gateway as an intermediary component that mediates between domains with different security protocols. The gateway receives insights from sensor applications in one domain, validates authorization tokens, and forwards approved insights to consumer applications in other domains. This intermediary architecture enables efficient cross-domain information sharing while maintaining centralized security control and authorization validation.
2Reliability
If centralized permission management is implemented, then authorization control is improved, but system complexity deteriorates
Solution Approach 1:
The patent implements a universal permission management system where a single gateway handles multiple functions: token validation, authorization checking, insight routing, and cross-domain communication. Instead of implementing separate permission management systems in each domain, the gateway provides centralized authorization control that works across all domains, reducing overall system complexity while maintaining strong authorization control.
3Reliability
If multiple authentication mechanisms are deployed across different domains, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The gateway acts as an intermediary that handles multiple authentication mechanisms and security protocols internally, while presenting a unified and simplified interface to applications. Applications only need to interact with the gateway using standard token-based authentication, without needing to implement or manage multiple different authentication mechanisms across domains. This maintains high security through supported multiple protocols while preserving ease of operation.
4Speed
If direct domain-to-domain communication is enabled, then communication speed is improved, but vulnerability to unauthorized access deteriorates
Solution Approach 1:
The gateway serves as a secure intermediary that all cross-domain communications must pass through. Instead of enabling direct domain-to-domain communication which would expose systems to unauthorized access, the gateway validates authorization tokens and filters insights before forwarding them between domains. This maintains communication speed through efficient token validation while protecting against unauthorized access through centralized security control.
Data Source
AI summary
A method at a first domain for obtaining at least one insight from a second domain, the method including synchronizing a permissions table at the first domain with a master permissions table at a network element; receiving a request for an insight from an application at a bridge in the first domain; confirming an identity of the application; verifying, at the bridge, application permissions using the permissions table at the first domain, the verifying confirming that the application has permission to access the insight; sending a request message from the first domain to the second domain, the request message being signed by a private key of the first domain and requesting the insight; and receiving the insight from the second domain.