Token-Based Access Control System for Offline Resource Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems for resources like locks and vehicles often require continuous connectivity to servers, limiting offline access and efficient delegation of access rights, and lack flexible, low-memory solutions for implementing complex access control logic.
Innovation Solution
A token-based system that enables offline access by using a token with a user key and software code, allowing interaction between a user device and a resource without server connectivity, and includes a virtual machine for executing executable code to control resource behavior, with features like delegation and constraint management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If continuous network connectivity is required for access control, then centralized management and remote deactivation are improved, but offline access capability deteriorates
Solution Approach 1:
The access control system is segmented into two parts: a lightweight token stored on the user device containing essential access credentials, and a full authentication system on the server. This segmentation allows offline access using the token while maintaining centralized management capability when connected, resolving the contradiction between continuous connectivity requirements and offline access needs.
Solution Approach 2:
Access credentials and authentication data are preliminarily loaded into the token on the user device before offline access is needed. This preliminary action enables the device to authenticate and access resources offline without requiring real-time server connectivity, while still allowing centralized management when online.
2Adaptability or versatility
If complex access control logic is implemented, then functionality and flexibility are improved, but memory requirements and device complexity deteriorate
Solution Approach 1:
A virtual machine acts as an intermediary between the compact token and the resource access control logic. The virtual machine interprets bytecode instructions stored in the token, enabling complex access control functionality to be executed with minimal memory footprint on the resource device, while maintaining high adaptability through programmable logic.
Solution Approach 2:
The access control logic is transformed from compiled machine code to bytecode that can be interpreted by a virtual machine. This parameter change in the execution model allows complex logic to be stored in a compact format in the token, reducing memory requirements while maintaining full functionality through interpretation.
3Reliability
If access credentials are stored on centralized servers only, then security and revocation capability are improved, but offline access and response time deteriorate
Solution Approach 1:
Authentication credentials and security data are preliminarily provisioned into the token on the user device before access is needed. This allows immediate offline authentication without server round-trips, reducing access response time while maintaining security through cryptographic verification. Centralized server updates can still revoke access by invalidating token credentials when online.
Solution Approach 2:
A copy of the essential authentication credentials is created and stored in the token on the user device, rather than requiring access to the central server for every authentication. This copy enables fast offline access while the original credentials remain secured on the server for revocation and management purposes.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to an example aspect of the present invention, there is provided an apparatus comprising: a memory configured to store a user key specific to a particular user or token; software code; a token relating to a second apparatus, the token comprising the user key and the software code, and at least one processing core configured to: participate in an interaction with the second apparatus, the interaction being based at least partly on the token and the user key and the interaction comprising transmitting the token to the second apparatus.