Widget Namespace Authorization via Token Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current standards do not allow a signed Web application (widget) to prove its authorization to act on behalf of or be identified as a certain namespace, resulting in limited access to local system resources compared to certified application vendors.
Innovation Solution
A technique is provided to assign a verified origin to a widget, allowing it to claim ownership of a namespace by mapping its URI to a URL, fetching a list of authorized signer identities, and validating its presence in that list to determine authorization privileges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If current standards are used for widget authorization, then certified application vendors can access local system resources, but signed Web applications cannot prove their authorization to act on behalf of a namespace
Solution Approach 1:
The patent introduces a namespace owner as an intermediary that issues binding tokens to authorized applications. This mediator (namespace owner) enables signed Web applications to prove their authorization by presenting tokens that bind the application to the namespace, resolving the contradiction between adaptability and reliability in authorization.
Solution Approach 2:
The patent implements preliminary authorization binding where the namespace owner pre-issues binding tokens to applications before they need to access resources. This preliminary action (pre-binding applications to namespaces with tokens) allows applications to later prove their authorization without real-time verification, enhancing both reliability and adaptability.
2Adaptability or versatility
If signed Web applications are limited in access compared to certified vendors, then system security is maintained, but application functionality and resource access are restricted
Solution Approach 1:
The patent enables self-service authorization where applications autonomously obtain binding tokens from namespace owners and use them to access resources. This self-service mechanism (applications independently proving their own authorization) increases resource access capability while avoiding the need for complex centralized authorization management.
Solution Approach 2:
The patent segments the authorization system into independent components: namespace owners who issue tokens, applications that hold tokens, and resource systems that verify tokens. This segmentation allows each component to operate independently, simplifying overall system complexity while enabling flexible resource access for signed Web applications.
3Duration of action of stationary object
If binding tokens are stored in persistent storage, then application authorization is maintained across sessions, but security risks increase from token theft or misuse
Solution Approach 1:
The patent implements dynamic token management where binding tokens can be configured with expiration times and refresh mechanisms. Instead of static persistent storage, tokens become dynamic credentials that can be revoked, expired, or refreshed, maintaining authorization persistence while reducing security vulnerabilities through controlled lifecycle management.
Solution Approach 2:
The patent changes the parameters of token storage by introducing expiration timestamps and validity periods. Tokens are stored with temporal parameters that automatically limit their usefulness, transforming static security risks into time-bounded credentials that reduce the window for potential theft or misuse while maintaining necessary persistence.
Data Source
Figure 1~2
Figure 3~5
Figure 4
AI summary
A method includes identifying an application installed on a device as an authorized application of a certain domain, the application being signed with a private key (7A); deriving a signer identity using a public key that forms a key pair with the private key (7B); mapping the certain domain to another domain using a deterministic function map (7C); making a request to the another domain to obtain a list of signer identities that are authorized to act on behalf of the certain domain (7D); determining whether the signer of the application is in the list and, if it is, authorizing the application to act with the same privileges as granted in the certain domain (7E). Apparatus and computer programs for performing the method are also disclosed.