Token-Based Access Control for Dynamic Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional systems for granting access to end-user data in companies provide unrestricted access to employees, leading to inefficiencies and potential legal liabilities due to lack of dynamic access control and usage restrictions.
Innovation Solution
Implementing a token-based access control system that assigns workflow-specific and default tokens to employees, allowing temporary access to specific data portions based on job needs, with cryptographic message authentication codes to prevent tampering and deactivation upon task completion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control tools are used to allow employees access to end-user data, then employees can access all or very large portions of data, but this leads to unauthorized access risks and lack of dynamic allocation
Solution Approach 1:
The patent segments access control into multiple token types (default tokens for general access rights and workflow-specific tokens for task-specific access). Each token represents a discrete access permission that can be independently managed, allowing fine-grained control over data access without requiring a completely complex access control system.
Solution Approach 2:
The patent implements dynamic access control where workflow-specific tokens are automatically generated, assigned, and deactivated based on workflow events. Access permissions change dynamically according to task requirements rather than being static, allowing the system to adapt to different workflow scenarios while maintaining security.
2Ease of operation
If traditional access control tools are used, then employees have broad access to data, but this results in inability to restrict data usage and potential legal liability
Solution Approach 1:
The patent incorporates feedback mechanisms where the system monitors workflow event completion and automatically deactivates workflow-specific tokens when tasks are finished. This feedback loop ensures that access permissions are automatically adjusted based on task completion status, preventing unauthorized continued access while maintaining ease of operation during active workflows.
Solution Approach 2:
The patent introduces tokens as intermediary objects that mediate between employees and end-user data. Rather than direct access, employees must use tokens that encode specific permissions and restrictions. This intermediary layer enables fine-grained control over data usage while maintaining operational convenience through automatic token management.
3Reliability
If workflow-specific tokens are assigned temporarily, then access is restricted to necessary data portions, but this requires dynamic token management system
Solution Approach 1:
The patent implements self-service automation where the system automatically generates workflow-specific tokens when workflow events occur, assigns them to appropriate employees, and deactivates them when tasks are completed. This self-service capability reduces manual intervention requirements while maintaining strong access control security through automated token lifecycle management.
Solution Approach 2:
The patent performs preliminary actions by pre-defining default tokens with general access rights and pre-configuring token assignment rules based on workflow types. This preliminary setup enables the system to quickly generate appropriate workflow-specific tokens without complex real-time decision-making, balancing security requirements with automation efficiency.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This solution dynamically allocates access to only the necessary data, enhancing data privacy and security while reducing legal risks and improving operational efficiency by ensuring that employees can only access the data required for their tasks.
Implementation Method 1
In some cases, a cryptographic message authentication code can be included with each token allowing for a detection of modification or tampering of the tokens.
Data Source
AI summary
Systems and methods for enabling token-based access control to data are provided. In particular, some embodiments use a token-based access management system to allow or restrict an individual's ability to access data. The access management system uses tokens to define rules (e.g., a Boolean matching rule or algorithm that results in a true/false output indicating the decision) within the access management system to determine if the token is valid and if the individual should be granted access to the requested data. Tokens may further have tool constraints for controlling access. In some cases, the tokens may expire upon completion of a task or after a pre-set amount of time. A generic workflow utilizing tokens and at least one specific workflow showing employees utilizing tokens as part of performing a task responsive to a user.