Wireless Terminal Access Control via Segmented Resource Groups
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In wireless communication systems, there is a need for a method to authenticate access authorization for M2M devices, particularly in scenarios where M2M servers need to be notified of updates to specific functions or resources, ensuring that only authorized operations are performed on resource groups.
Innovation Solution
A method and apparatus for authenticating operation commands in a wireless communication system, involving the creation and management of resource groups for access control, using identifiers and access control lists (ACLs) to determine the rights of operation commands, with specific bits indicating allowed operations, and utilizing bootstrap and device management interfaces for command reception and execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control is implemented for M2M devices with high access rights, then system security is improved, but device complexity increases
Solution Approach 1:
The patent segments access control by creating separate resource groups for different operation commands (Create, Read, Write, Delete). Each resource group contains an ACL that specifically controls access rights for that type of operation, allowing fine-grained security control without requiring complex centralized authentication for every command.
Solution Approach 2:
The patent implements preliminary action by pre-configuring ACLs in resource groups before operations are executed. The ACLs are established in advance during resource group creation, so that when operation commands are received, the terminal can immediately check against pre-defined rules without performing complex real-time authentication negotiations.
2Measurement precision
If resource groups with ACLs are created for each operation command, then access authorization precision is improved, but system overhead increases
Solution Approach 1:
The patent creates universal resource groups that can handle multiple operation types (Create, Read, Write, Delete) within a single structured framework. Each resource group serves as a multi-functional container that can authorize different command types through its ACL, reducing the need for separate authorization mechanisms for each operation.
Solution Approach 2:
The patent uses parameter changes by representing ACLs as bit fields where specific bits correspond to specific operation rights. This allows precise control over which operations are permitted by simply changing bit values in the ACL parameter, enabling fine-grained authorization precision through simple parameter manipulation rather than complex rule sets.
3Reliability
If authentication is performed for every operation command, then system security is improved, but operation speed decreases
Solution Approach 1:
The patent performs authentication preliminarily by pre-establishing ACLs in resource groups before operations occur. When operation commands are received, the terminal performs simple bit-field comparisons against pre-configured ACLs rather than executing full authentication protocols, significantly speeding up the authorization process while maintaining security.
Solution Approach 2:
The patent uses copying by creating simplified copies of authentication rules in the form of ACL bit fields within each resource group. Instead of repeatedly executing complex authentication protocols, the system uses these pre-copied authorization rules for rapid command validation, maintaining security through accurate rule replication while improving operation speed.
Data Source
Figure 1~2
Figure 3(a)~3(d)
Figure 4~5
AI summary
A method for a terminal for authenticating an authorization for a particular command in a wireless communication system according to an embodiment of the present invention can comprise the steps of: receiving, from a first sever, a command for generating a resource group for access control to be used for authenticating an authorization of the command for generating a particular resource group; generating the resource group for access control; receiving, from a second server, a command for generating the particular resource group; and authenticating the command, for generating the particular resource group, on the basis of the generated resource group for access control.