User Certificate with Authorization for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control methods for computer systems and websites are vulnerable to security risks due to the reliance on user login and password combinations, which can be compromised, especially with increased remote work, and require separate administrator verification for access authorizations.
Innovation Solution
Implementing a user device certificate that stores both identification and authorization information, using a Hardware Security Module (HSM) to secure and manage these certificates, allowing them to be used for authentication and authorization without the need for passwords, and supporting multiple certificate formats for compatibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user login and password are used for access control, then authentication can be performed, but security risks increase and the system requires separate administrator verification for authorization
Solution Approach 1:
The patent combines authentication and authorization into a single certificate structure. The certificate contains both the user's identity information and their authorization permissions, eliminating the need for separate authentication and authorization verification processes that exist in traditional login/password systems with administrator databases.
Solution Approach 2:
The certificate serves multiple functions simultaneously: it acts as an authentication credential proving the user's identity, as an authorization token containing permission information, and as a portable security credential that can be used across different systems and platforms without requiring system-specific administrator verification.
2Reliability
If certificates are stored in Hardware Security Module (HSM), then security is enhanced through hardware protection, but the system requires specialized hardware infrastructure
Solution Approach 1:
The patent introduces a certificate translation layer that acts as an intermediary between the HSM-stored certificate and various platform-specific certificate formats. This translation layer converts the standardized certificate structure into platform-specific formats (such as Windows certificates, macOS certificates, mobile device certificates) while maintaining the security benefits of HSM storage, thus enabling cross-platform compatibility without requiring platform-specific hardware infrastructure.
3Measurement precision
If separate certificates are used for each authorization, then authorization precision is improved, but device complexity increases
Solution Approach 1:
The patent segments authorization permissions into distinct fields within the certificate structure, allowing each permission to be independently defined and verified. This segmentation enables precise authorization control where each permission can be individually granted or revoked without affecting other permissions, while maintaining a single unified certificate rather than multiple separate certificates.
Data Source
AI summary
In embodiments, a user device stores a certificate that both identifies the user and indicates what the user is authorized to access. When access is desired, the certificate is provided. Instead of a user login and password, the signed certificate functions to identify the user (and also the user device). Instead of separately accessing an administrator table to verify whether the user is authorized to access the website or program or other resource, the certificate on the user device is consulted.