Token-Based Access Control for Multi-Device Information Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In existing information processing systems, users are required to input second authentication information whenever accessing a specific service from different information processing devices, even if they have already authenticated using common first authentication information, leading to inconvenient repeated login processes.
Innovation Solution
The system includes a display controller that prompts users for second authentication information only when first access permission information is not stored, and permits access and stores new access permission information if the input matches the predetermined authentication, allowing seamless access across devices using a token-based authorization mechanism similar to OAuth 2.0, where an R-token is used to skip the login process when available.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users are required to input second authentication information for each service access from different devices, then security is maintained, but user convenience deteriorates due to repeated login processes
Solution Approach 1:
The system performs preliminary authentication when the user first accesses a service from a device, stores the authentication result (first access permission information) in association with device identification, and reuses this stored information for subsequent accesses from the same device. This eliminates the need for repeated authentication inputs while maintaining security, as the pre-stored permission information is validated against the service requirements.
2Ease of operation
If authentication information is stored for multiple devices, then access convenience is improved, but system complexity increases due to token management across devices
Solution Approach 1:
The system uses a universal first authentication information (such as a refresh token or authorization code) that can be stored and reused across multiple information processing devices. This single authentication credential serves multiple functions: it can be stored in any device, validated by the information processing system, and used to obtain second authentication information for service access on any device, eliminating the need for device-specific authentication management.
3Ease of operation
If the system checks for stored access permission information before each service access, then unnecessary authentication inputs are eliminated, but processing time increases due to additional lookup operations
Solution Approach 1:
The system extracts only the essential first access permission information (such as a refresh token or authorization code) from the complete authentication data set and stores it separately in association with device identification. During service access, the system performs a quick lookup of this extracted token rather than re-processing complete authentication credentials, significantly reducing processing time while still enabling seamless access across devices.
Data Source
AI summary
Provided is an information processing system including plural information processing devices each of which is accessible using first authentication information that is given to each of users, that varies among the users, and that is common to the plural information processing devices, access to a specific service from an accessed information processing device among the plural information processing devices being permitted using second authentication information that is given for the specific service to each of the users and that varies among the users. The information processing system includes a display controller and a storage controller. In a case where first access permission information that corresponds to the first authentication information used to access the accessed information processing device and that is for permitting access to the specific service is not stored in a storage unit, the display controller performs control to display an input screen for inputting the second authentication information for accessing the specific service. In a case where the first access permission information is stored in the storage unit and in a case where authentication information input from the input screen matches the second authentication information that is predetermined, the storage controller permits access to the specific service and performs control to cause the storage unit to store new first access permission information for the specific service in association with the first authentication information used to access the accessed information processing device.