Token-Based Rights Delegation for Controlled User Actions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for delegating user actions lack flexibility and security, as they either require cumbersome administrator involvement or allow the delegate to perform actions without user control, leading to potential misuse.
Innovation Solution
A method involving a delegation token system that allows a first user to delegate actions to a second user while maintaining control through predefined rules and user consent requests, using separate communication networks for authorization and agreement requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the user transmits their credentials to the person to whom they delegate access rights, then the delegated person can perform actions on behalf of the user, but the user loses control over the actions performed and cannot retrieve their credentials
Solution Approach 1:
The patent segments the authentication process into two distinct components: credentials (username/password) and authorization token. The user retains their credentials while a separate, time-limited authorization token is generated for the delegated person. This segmentation allows the user to maintain control over their account while enabling the delegated person to perform specific actions without accessing the user's credentials.
Solution Approach 2:
The patent introduces an intermediary authorization token that mediates between the user and the delegated person. Instead of directly sharing credentials, the system generates a token that serves as an intermediate credential. This token can be used by the delegated person to perform authorized actions while the user can revoke or control the token's validity, thus maintaining user control through the intermediary mechanism.
2Reliability
If the user contacts each site administrator to request the delegation of access rights, then the delegation can be established, but the process becomes cumbersome and lacks flexibility
Solution Approach 1:
The patent implements a self-service delegation mechanism where the user can autonomously generate and manage authorization tokens without contacting site administrators. The system provides automated token generation, validation, and revocation capabilities that empower users to manage their own delegations. This self-service approach eliminates the need for administrator involvement while maintaining secure control through predefined policies and user-initiated token management.
3Ease of operation
If the delegated person changes the password without communicating the new password to the user, then the delegated person maintains access, but the user can no longer perform actions themselves
Solution Approach 1:
The patent segments authentication into credentials (retained by user) and authorization tokens (given to delegated person). Since the delegated person only receives the token and not the credentials, they cannot change the password or affect the user's ability to authenticate. This segmentation prevents the delegated person from compromising user access while still allowing them to perform authorized actions using the token.
Solution Approach 2:
The patent implements beforehand cushioning by designing the authorization system to be inherently resistant to password changes by the delegated person. The architecture is prepared in advance to distinguish between credential-based authentication (user control) and token-based authorization (delegated access). This prior design ensures that even if the delegated person attempts to change credentials, it does not affect the user's ability to authenticate and maintain control.
Data Source
Figure 1
Figure 2~4
Figure 3
AI summary
The invention relates to a method for controlling an action. According to the invention, the method is adapted to receive an authorisation request relating to at least one action for which a first user (U) has execution rights, and for which a command has been formulated by a second user (Y), the request containing data relating to the action and a delegation token certifying a delegation of the action by the first user (U) to the second user (Y), to determine a first result, to send, to a terminal (MU) of said first user, an agreement request if it is determined that a user agreement must be requested and to send a response to the authorisation request signalling a refusal or an agreement for said action, said response being obtained according to a response to the agreement request or being the first result. The invention also relates to a control device (SC) implementing the method of control.