Trusted Access Tokens for Private Cross-Organization Content Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely sharing data across multiple organizations while maintaining user privacy and providing an audit trail, as current authentication methods like single sign-on and centralized identity management can be costly and difficult to implement, and may compromise user privacy or lose visibility on content access.
Innovation Solution
A computer-implemented method and system that generates a trusted token based on a user ID, omitting identifying information and incorporating a proof of authentication, allowing secure access to secured content without revealing user identity, while enabling accurate audit logs through non-correlation of user activities across login sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (single sign-on, centralized identity management) are used to authenticate external users, then access control reliability is improved, but device complexity and implementation cost increase
Solution Approach 1:
The patent introduces a trusted token as an intermediary mechanism between the user and the secured content. The token contains a proof of authentication and a variable term that links to user activity without exposing identifying information. This intermediary structure enables reliable access control while avoiding the complexity of traditional centralized authentication systems.
Solution Approach 2:
The patent extracts the essential authentication verification function from complex identity management systems. By using a trusted token that contains only the necessary proof of authentication and variable term, the system separates authentication reliability from the complexity of user identity management, implementing only the minimal required functionality.
2Measurement precision
If user identifying information is collected for audit trails, then measurement precision of user activities is improved, but loss of information (user privacy) increases
Solution Approach 1:
The patent applies local quality by differentiating between types of information in the audit trail. The variable term in the trusted token provides sufficient information to link user activities across sessions for accurate auditing, while deliberately excluding permanent identifying information. This creates different information qualities for different purposes: enough for audit accuracy, but minimal for privacy protection.
Solution Approach 2:
The variable term functions as a disposable identifier that serves its purpose for audit tracking then becomes obsolete. Each trusted token contains a unique variable term that enables precise audit trails for the duration of the authentication session, but this information does not persist to compromise long-term user privacy. The identifier is effective for its intended purpose and then discarded.
3Ease of operation
If permanent user identifiers are used across sessions, then ease of operation is improved, but object-generated harmful factors (privacy compromise) increase
Solution Approach 1:
The patent implements dynamics by making the user identifier transient rather than permanent. The variable term in each trusted token changes with each authentication session, allowing the system to adapt to different security requirements. This dynamic approach maintains operational ease for users while automatically adjusting the level of identifying information based on session-specific needs, thereby preventing permanent privacy compromise.
Data Source
AI summary
A method may include obtaining, from a requesting entity system, a request to access secured content stored at a provisioning entity system, the request comprising user identifying data associated with a user of the requesting entity system, determining a user ID usable to identify the user with the requesting entity system without being usable to identify the user with the provisioning entity system, generating a trusted token for use in accessing the secured content, comprising generating a variable term different from other variable terms generated for other requests, incorporating the variable term in the trusted token, omitting remaining user identifying information present in the request from the trusted token, and incorporating a proof of authentication in the trusted token to enable the provisioning entity system to validate the trusted token, and transmitting the trusted token to the requesting entity system for use by the user in accessing the secured content.