Maintaining confidentiality in a decentralized strategy

Abstract

The present disclosure relates to a method for maintaining confidentiality of metadata in a decentralized policy. In the method, a processor may generate one or more encryption policies associated with a policy creator. The processor may generate token metadata associated with a user using the one or more encryption policies. The processor may encrypt the token metadata to form encrypted token metadata. The processor may send the one or more encryption policies and the encrypted token metadata to a policy evaluator. The policy evaluator may evaluate the one or more encryption policies and the encrypted token metadata. The processor may return a response. The response may be based on the evaluation of the policy evaluator.

Description

Technical Field

[0001] The present disclosure relates generally to the field of decentralized policies and, more particularly, to methods and techniques for maintaining privacy and ensuring confidentiality of information of users associated with decentralized policies. Background Art

[0002] Data privacy has become a growing concern over the past decade as technological advances in data mining have allowed for the collection of large portions of personal data. Typically, in decentralized policies, data not relevant to performing a specific policy function (e.g., the identity of the policy holder) may be shared with actors who do not have the same level of trust as the policy issuer. Therefore, methods and techniques are needed to ensure that personal, private information remains confidential. Summary of the invention

[0003] Embodiments of the present disclosure include methods, computer program products, and systems for maintaining confidentiality of metadata in a decentralized policy. A processor may generate one or more encryption policies associated with a policy creator. The processor may utilize the one or more encryption policies to generate token metadata associated with a user. The processor may encrypt the token metadata to form encrypted token metadata. The processor may send the one or more encryption policies and the encrypted token metadata to a policy evaluator. The policy evaluator may evaluate the one or more encryption policies and the encrypted token metadata. The processor may return a response. The response may be based on the evaluation of the policy evaluator.

[0004] The above summary is not intended to describe each illustrated embodiment or every implementation of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] The accompanying drawings included in the present disclosure are incorporated into and form a part of the specification. They show embodiments of the present disclosure and are used to explain the principles of the present disclosure together with the specification. The accompanying drawings only illustrate certain embodiments and do not limit the present disclosure.

[0006] Figure 1 A block diagram of a system for maintaining confidentiality of metadata in a decentralized strategy according to an embodiment of the present disclosure is shown.

[0007] Figure 2 A flow chart illustrating a method of maintaining confidentiality of metadata in a decentralized strategy according to an embodiment of the present disclosure.

[0008] Figure 3A A cloud computing environment according to an embodiment of the present disclosure is shown.

[0009] Figure 3B An abstract model layer according to an embodiment of the present disclosure is shown.

[0010] Figure 4A high-level block diagram of an example computer system that may be used to implement one or more of the methods, tools, and modules described herein, and any related functionality, according to an embodiment of the present disclosure is shown.

[0011] Although the embodiments described herein may be modified into various modifications and alternative forms, the details thereof have been shown by way of example in the accompanying drawings and will be described in detail. However, it should be understood that the specific embodiments described should not be construed as limiting. On the contrary, the present invention will encompass all modifications, equivalents and alternatives that fall within the spirit and scope of the present disclosure. DETAILED DESCRIPTION

[0012] The present disclosure generally relates to the field of decentralized policies, and more specifically, to methods and techniques for maintaining privacy and ensuring confidentiality of information of users associated with decentralized policies. Although the present disclosure is not necessarily limited to such applications, various aspects of the present disclosure may be understood through discussion of various examples using this context.

[0013] Typically, a control plane or a third-party cloud provider can manage policy services for various policy holders in a decentralized policy management configuration. In this configuration, the control plane of the management service cannot be fully trusted. Typically, the control plane is managed by a third-party company and its employees. Those third parties or anyone who accesses the policy service may be able to see the orchestration components of the policy and its metadata. Typically, these third parties are not authenticated to access the data / information and may lack specific compliance requirements. As a result, only a specific trust level can be assigned to the control plane. For example, software as a service authorization is typically based on a token that describes a person or service. When a policy holder (e.g., a user or administrator) issues a call or query about a specific policy to the control plane, the policy holder must provide some private details / data or attributes (e.g., metadata) that describe and verify the identity of the policy holder to ensure that they are authorized to access the policy. These private details / data may include, but are not limited to, the policy holder's address, customer identification number, and company or product name.

[0014] These private details, since they are not widely known, can be matched with the information listed in the policy to prevent unauthorized parties from accessing the data or secrets configured in the policy. Depending on how the policy is structured, the private details / data required to verify the authorized user / policy holder to access specific information or objects in the policy may be closely related to the private details or attributes of a specific identity. In policy-based decision making, the control plane may be processing various private details or attributes, which may be sensitive in nature (e.g., the policy holder may expect to keep confidentiality). If these private details / attributes are encrypted during the duration that the control plane accesses them (e.g., during the decision-making process), these private details / attributes can remain confidential and secure. This can be particularly beneficial during the authorization process in which the private details / attributes are matched with the information provided in the policy. For example, the authorization process may be managed by a provider (e.g., external authentication) that may lack compliance requirements (e.g., those imposed by government agencies (such as the National Institute of Standards and Technology)) or may not be authenticated to see the private details / attributes associated with the policy query of the policy holder. Therefore, there is a need for methods and techniques that provide policy issuers with the ability to have more granular control over private details / attributes to ensure that the data remains confidential or private.

[0015] In embodiments discussed herein, solutions are provided in the form of methods, systems, and computer program products for maintaining confidentiality of metadata in decentralized policies. Embodiments contemplated herein maintain confidentiality of metadata (e.g., private details / attributes) for policy holders in decentralized policies. Maintaining confidentiality for policy holders can ensure anonymity of the policy holder's clients, protect subscription details associated with the policy holder or its clients, or any other information that may be associated with a particular policy.

[0016] In an embodiment, the processor may be configured to generate one or more encrypted policies (e.g., encrypted with homomorphic encryption) associated with a policy creator. A policy creator may include any person or entity that configures or defines a policy (e.g., a policy issuer). In an embodiment, a policy creator may access one or more policies and metadata (e.g., private details / attributes) associated with a policy holder (e.g., a user, an administrator, an application / application software, etc.). In an embodiment, a policy creator is considered a fully trusted party within a decentralized policy management configuration.

[0017] In an embodiment, the processor may utilize one or more encryption strategies to generate token metadata of metadata associated with a user / application. By tokenizing the metadata, private details / attributes found within the metadata may be converted into a random string (e.g., a token). The random string may reference the original data, however, the random string cannot generally be reverse engineered.

[0018] In an embodiment, the processor may encrypt the token metadata to form encrypted token metadata. By encrypting the token metadata, any third party or unauthorized person / process may be prevented from reading the metadata. Although any type of encryption process may be used, in some embodiments, homomorphic encryption may be used to encrypt the token metadata. In some embodiments, the processor may configure the encrypted token metadata into a JSON Web Token (JWT token). A JWT token is a method of encapsulating information that is typically easy to read but cannot be tampered with. A JWT token typically includes public key information and a payload. For example, if the payload of the token is modified, it will not match the signature.

[0019] Although in some embodiments, the processor may send one or more encryption policies and encryption token metadata directly to the policy evaluator, in other embodiments, a resource server (e.g., a service-specific purpose server) may pass one or more encryption policies and encryption token metadata to the policy evaluator. The resource server may be configured to manage one or more different resources, including but not limited to storage devices, CPUs, memories, containers, networks, or any combination thereof. In some embodiments, in order to optimally provision resources, the server may need to request some additional information about the application of the resource. This information may include specific metadata that must be encrypted.

[0020] In an embodiment, a policy evaluator (e.g., an engine) can determine a policy action associated with one or more encryption policies. The policy evaluator can be any party within a decentralized policy management configuration that lacks full trust (e.g., lacks a confidentiality certificate). In some embodiments, the policy evaluator and other parties that lack trust may not be able to access metadata associated with a user / application. In some embodiments, the policy evaluator can obtain a JWT token. In some embodiments, the policy evaluator can be configured to store one or more encryption policies generated by a policy creator.

[0021] In embodiments, the policy evaluator may evaluate one or more encryption policies and encryption token metadata. In some embodiments, the policy evaluator may determine an evaluation result. In these embodiments, the evaluation result may be based on an evaluation of the one or more encryption policies and encryption token metadata by the policy evaluator. In these embodiments, the policy evaluator may perform a decision based on the evaluation result.

[0022] In an embodiment, in response to evaluating one or more encryption policies and encryption token metadata, a response (e.g., which may be as simple as a true / false response) may be generated / returned based on determining the evaluation result. For example, a processor may determine whether resource Y having attributes A, B, C, and D can access resource X (e.g., the evaluation result) and generate a yes or no response. In these embodiments, the evaluation result may be based at least in part on an evaluation of one or more encryption policies and encryption token metadata by a policy evaluator. In an embodiment, a policy evaluator may perform a decision based at least in part on the evaluation result. In these embodiments, the processor may forward the evaluation result to a resource server. In these embodiments, the resource server may generate a response and may return the response to the user / application.

[0023] In an exemplary embodiment, medical application software (e.g., an application) may require resources provided by a resource server to render a medical simulation. The configuration of the resource server or the size of the resources (e.g., CPU, memory, storage device, and / or number of containers) and the duration required to render the simulation (e.g., process data) may depend on the number of test cases for a specific group of patients in a specific county. In this example, regulations of a specific county require that all patient data be processed in a data center in the specific county. In this exemplary embodiment, a request to a policy evaluator may include: given the following patient data, whether the following simulation can be rendered, and if so, assuming the following set of policies, how many resources will be required. In this example, the response to the above request may be that resources A, B, and C are available for the next two hours.

[0024] Reference now Figure 1 , depicts a block diagram 100 of a system for maintaining confidentiality of metadata in a decentralized strategy according to an embodiment of the present disclosure. Figure 1 The illustration of only one implementation is provided and does not imply any limitation on the environments in which different embodiments may be implemented. Many modifications to the described environment may be made by those skilled in the art without departing from the scope of the invention as recited in the claims.

[0025] In an embodiment, a system for maintaining confidentiality of metadata in a decentralized policy (e.g., system 100) may include an actor policy creator 102, an application / user 104, a resource server 106, and a policy evaluator 108. Although in some embodiments, the system 100 may be divided into a bootstrap 110 portion and an authorization 112 portion, in other embodiments, some or all of the components contemplated herein may be configured within the bootstrap 110 portion, or alternatively, some or all of the components may be configured within the authorization 112 portion.

[0026] In embodiments, the bootstrap 110 may include a policy creator 102 that generates one or more encryption policies. The one or more policies may be encrypted using any available encryption (e.g., homomorphic encryption). In these embodiments, the policy creator 102 may generate an encryptor key 118. The encryptor key 118 may be configured in any form of a key or function that may be used in the system 100. In some embodiments, the policy creator 102 may define one or more policies to be encrypted. In these embodiments, the policy creator 102 may be configured to access metadata (e.g., private details / attributes of a user / application) associated with the one or more encryption policies.

[0027] In embodiments, the bootstrap 110 may pass the encryptor key 118 to the key encryptor storage 120. In some embodiments, the user / application 104 may be configured to store the encryptor key 118 in association with one or more of the policies of the user / application 104 (e.g., parties providing private details / attributes such as identities). In embodiments, one or more encryption policies generated by the policy creator 102 may be stored in the encryption policy storage 116. In these embodiments, the encryption policy storage 116 may be managed by the policy evaluator 108.

[0028] In embodiments, system 100 may include an authorization 112 portion. In the authorization 112 portion, a user / application may generate token metadata that is metadata associated with one or more encryption policies of user / application 104. In these embodiments, the metadata may include identity information or any other information that user / application 104 may desire to be confidential (e.g., private details / attributes). In embodiments, user / application 104 may encrypt the token metadata with an encryptor to form encrypted token metadata 124. In some embodiments, the user / application may delegate this responsibility to another component (e.g., ) and demonstrate the user / application 104's trust in the component. For example, the user / application may not be able to perform a specific operation due to one or more restrictions. For example, hardware encryption that can only be performed on special hardware may be required to meet specific security requirements. For example, a trusted platform module (TPM) or other hardware that can be configured to store encryption keys for encryption can be used. In some embodiments, a security device (such as a hardware security module) can be added to manage, generate, and securely store encryption keys.

[0029] In an embodiment, the user / application 104 may pass the encrypted token metadata 124 to the resource server 106. The resource server 106 may be any server associated with a particular purpose. In an embodiment, the resource server 106 may pass the encrypted token metadata 124 to the policy evaluator 108 (e.g., forward the token to the policy evaluator 126). In some embodiments, the policy evaluator 108 may obtain the encrypted token metadata 124 with the JWT token (e.g., obtain the JWT token with encrypted metadata 128). In an embodiment, the policy evaluator 108 may evaluate the encrypted token metadata against the encryption policy stored in the encryption policy storage device 116 (e.g., evaluate the encrypted metadata 130 with the encryption policy), and may generate an evaluation result. In an embodiment, the policy evaluator 108 may perform / determine a policy decision based at least in part on the evaluation result (e.g., perform a decision 132 based on the evaluation result). In an embodiment, the policy evaluator 108 may forward the decision to the resource server 106. In these embodiments, the resource server 106 may determine a response. In these embodiments, after the resource server 106 determines the response, the resource server can return the response to the user / application 105 based on the policy (eg, return the response based on the policy).

[0030] Reference now Figure 2 , a flow chart of an example method 200 for maintaining confidentiality of metadata in a decentralized policy according to an embodiment of the present disclosure is shown. In some embodiments, the method 200 begins at operation 202, in which the processor generates one or more encryption policies associated with a policy creator. In some embodiments, operation 202 may be included in a boot process (such as Figure 1 The process in the boot process 110).

[0031] In some embodiments, the method 200 proceeds to operation 204. At operation 204, the processor may generate token metadata associated with the user using one or more encryption policies. In some embodiments, the method 200 proceeds to operation 206. At operation 206, the processor encrypts the token metadata to form encrypted token metadata.

[0032] In some embodiments, method 200 proceeds to operation 208. At operation 208, the processor may send the one or more encryption policies and the encryption token metadata to a policy evaluator. While in some embodiments, the one or more encryption policies and the encryption token metadata are sent to the policy evaluator at the same time, in other embodiments, the one or more encryption policies and the encryption token metadata are sent to the policy evaluator at different times. In an embodiment, the policy evaluator may evaluate the one or more encryption policies and the encryption token metadata.

[0033] In some embodiments, method 200 proceeds to operation 210. At operation 210, the processor may return a response. In an embodiment, the response is based on the evaluation of the policy evaluator. In some embodiments, Figure 2 As depicted, after operation 210, method 200 may end. In an embodiment, operations 204 to 210 may be included in an authorization process (such as Figure 1 The process in the authorization process 112).

[0034] As discussed in greater detail herein, it is contemplated that some or all of the operations of method 200 may be performed in an alternate order or may not be performed at all; furthermore, multiple operations may occur concurrently or as internal parts of a larger process.

[0035] It should be understood that although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings recorded herein is not limited to cloud computing environments. Instead, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0036] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a pool of shared, configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, VMs, and services) that can be quickly provisioned and released with minimal management cost or interaction with the service provider. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0037] Features are as follows:

[0038] On-demand self-service: Cloud consumers can unilaterally and automatically provision computing capacity (such as server time and network storage) on demand without manual interaction with the service provider.

[0039] Broad network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate the use of heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0040] Resource pooling: The computing resources of a provider are grouped into resource pools to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. Generally, consumers cannot control or know the exact location of the provided resources, but can specify the location at a higher level of abstraction (such as country, state, or data center), thus having location independence.

[0041] Rapid elasticity: Capacity can be rapidly and elastically (in some cases automatically) provisioned to scale out quickly and released quickly to scale down quickly. To the consumer, the capacity available for provisioning often appears to be unlimited and can be purchased in any quantity at any time.

[0042] Measurable services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being utilized.

[0043] The service model is as follows:

[0044] Software as a Service (SaaS): The capability provided to consumers is to use the provider's applications running on a cloud infrastructure. Applications can be accessed from a variety of client devices through a thin client interface such as a web browser (e.g., web-based email). Aside from limited user-specific application configuration settings, consumers neither manage nor control the underlying cloud infrastructure including networks, servers, operating systems, storage, or even individual application capabilities.

[0045] Platform as a Service (PaaS): The capability provided to consumers is to deploy applications created or acquired by consumers on the cloud infrastructure, which are created using programming languages ​​and tools supported by the provider. Consumers neither manage nor control the underlying cloud infrastructure including networks, servers, operating systems or storage, but have control over the applications they deploy and may also have control over the configuration of the application hosting environment.

[0046] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, network, and other basic computing resources on which consumers can deploy and run arbitrary software including operating systems and applications. Consumers neither manage nor control the underlying cloud infrastructure, but have control over the operating system, storage, deployed applications, and may have limited control over selected network components (e.g., host firewalls).

[0047] The deployment model is as follows:

[0048] Private cloud: Cloud infrastructure is run solely for an organization. It can be managed by that organization or a third party and can exist inside or outside the organization.

[0049] Community cloud: The cloud infrastructure is shared by several organizations and supports a specific community with common interests (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist inside or outside the organization.

[0050] Public cloud: Cloud infrastructure is available to the general public or large industry groups and is owned by an organization that sells cloud services.

[0051] Hybrid cloud: A cloud infrastructure consisting of two or more clouds (private, community, or public) that remain distinct entities but are bound together by standardized or proprietary technologies (e.g., cloud bursting for load balancing between clouds) that enable data and application portability.

[0052] Cloud computing environments are service-oriented, with characteristics centered on statelessness, low coupling, modularity, and semantic interoperability. The core of computing is the infrastructure that includes a network of interconnected nodes.

[0053] Reference now Figure 3A , an illustrative cloud computing environment 310 is described. As shown, the cloud computing environment 310 includes one or more cloud computing nodes 300 with which a local computing device used by a cloud consumer can communicate, such as a personal digital assistant (PDA) or cellular phone 300A, a desktop computer 300B, a laptop computer 300C, and / or an automobile computer system 300N. The nodes 300 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks (such as a private cloud, community cloud, public cloud, or hybrid cloud, or a combination thereof, as described above). This allows the cloud computing environment 310 to provide infrastructure as a service, platform as a service, and / or software as a service without the cloud consumer needing to maintain resources for them on a local computing device. It should be understood that Figure 3A The various types of computing devices 300A-N shown in the figure are merely illustrative, and the computing node 300 and the cloud computing environment 310 can communicate with any type of computing device over any type of network and / or network addressable connection (eg, using a web browser).

[0054] Reference now Figure 3B , showing the cloud computing environment 310 ( Figure 3A ) provides a set of functional abstraction layers. First of all, it should be understood that Figure 3B The components, layers and functions shown are merely illustrative, and embodiments of the present invention are not limited thereto. As shown in the figure, the following layers and corresponding functions are provided:

[0055] The hardware and software layer 315 includes hardware and software components. Examples of hardware components include: mainframe 302; server 304 based on RISC (Reduced Instruction Set Computer) architecture; server 306; blade server 308; storage device 311; and network and networking components 312. In some embodiments, software components include network application server software 314 and database software 316.

[0056] Virtualization layer 320 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 322 ; virtual storage 324 ; virtual networks 326 , including virtual private networks; virtual applications and operating systems 328 ; and virtual clients 330 .

[0057] In one example, the management layer 340 may provide the functionality described below. Resource provisioning functionality 342 provides dynamic acquisition of computing resources and other resources for performing tasks in a cloud computing environment. Metering and pricing functionality 344 provides cost tracking of resources used within a cloud computing environment and provides bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security functionality provides identity authentication for cloud consumers and tasks and provides protection for data and other resources. User portal functionality 346 provides access to the cloud computing environment for consumers and system administrators. Service level management functionality 348 provides allocation and management of cloud computing resources to meet required service levels. Service level agreement (SLA) planning and fulfillment functionality 350 provides pre-scheduling and procurement of cloud computing resources for which future demand is predicted in accordance with the SLA.

[0058] The workload layer 360 provides examples of functions that can take advantage of the cloud computing environment. In this layer, examples of workloads and functions that can be provided include: mapping and navigation 362; software development and lifecycle management 364; virtual classroom teaching delivery 366; data analysis processing 368; transaction processing 370; and maintaining confidentiality of metadata in a decentralized strategy 372.

[0059] Figure 4 A high-level block diagram of an example computer system 401 according to an embodiment of the present invention is shown, which computer system can be used to implement one or more of the methods, tools, and modules described herein and any related functionality (e.g., using one or more processor circuits of a computer or a computer processor). In some embodiments, the main components of the computer system 401 may include one or more processors 402, a memory subsystem 404, a terminal interface 412, a storage interface 416, an I / O (input / output) device interface 414, and a network interface 418, all of which may be directly or indirectly communicatively coupled for inter-component communication via a memory bus 403, an I / O bus 408, and an I / O bus interface unit 410.

[0060] Computer system 401 may include one or more general purpose programmable central processing units (CPUs) 402A, 402B, 402C, and 402D, collectively referred to herein as CPUs 402. In some embodiments, computer system 401 may include multiple processors for a relatively large system; however, in other embodiments, computer system 401 may instead be a single CPU system. Each CPU 402 may execute instructions stored in a memory subsystem 404 and may include one or more levels of onboard cache.

[0061] System memory 404 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 422 or cache 424. Computer system 401 may also include other removable / non-removable volatile / non-volatile computer system storage media. By way of example only, storage system 426 may be provided for reading and writing from and to non-removable non-volatile magnetic media (such as hard disk drives). Although not shown, a disk drive for reading and writing from and to a removable non-volatile disk (e.g., a floppy disk) or an optical drive for reading or writing from or to a removable non-volatile optical disk (such as a CD-ROM, DVD-ROM or other optical media) may be provided. In addition, memory 404 may include flash memory, such as a flash stick drive or a flash drive. The memory device may be connected to memory bus 403 via one or more data medium interfaces. Memory 404 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of different embodiments.

[0062] One or more programs / utilities 428, each having at least one set of program modules 430, may be stored in memory 404. Programs / utilities 428 may include a hypervisor (also referred to as a virtual machine monitor), one or more operating systems, one or more application programs, other program modules, and program data. Each or some combination of an operating system, one or more application programs, other program modules, and program data may include an implementation of a networking environment. Programs 428 and / or program modules 430 generally perform the functions or methods of various embodiments.

[0063] Although the memory bus 403 is Figure 4403, but in some embodiments, the memory bus 403 may include multiple different buses or communication paths, which may be arranged in any of a variety of forms, such as hierarchical point-to-point links, star or mesh configurations, multi-layer buses, parallel and redundant paths, or any other appropriate type of configuration. In addition, although the I / O bus interface 410 and the I / O bus 408 are shown as a single corresponding unit, in some embodiments, the computer system 401 may include multiple I / O bus interface units 410, multiple I / O buses 408, or both. In addition, although multiple I / O interface units are shown that separate the I / O bus 408 from the various communication paths leading to various I / O devices, in other embodiments, some or all of the I / O devices may be directly connected to one or more system I / O buses.

[0064] In some embodiments, computer system 401 may be a multi-user mainframe computer system, a single-user system, or a server computer, or a similar device with little or no direct user interface but receiving requests from other computer systems (clients). Further, in some embodiments, computer system 401 may be implemented as a desktop computer, a portable computer, a laptop or notebook computer, a tablet computer, a pocket computer, a phone, a smart phone, a network switch or router, or any other suitable type of electronic device.

[0065] Notice, Figure 4 The main components of the exemplary computer system 401 are intended to be depicted. However, in some embodiments, the various components may have more Figure 4 The greater or lesser complexity represented in , may exist different from Figure 4 Components or additional components to those shown, and the number, type, and configuration of these components may vary.

[0066] As discussed in greater detail herein, it is contemplated that some or all of the operations of some embodiments of the methods described herein may be performed in an alternate order or may not be performed at all; furthermore, multiple operations may occur concurrently or as internal parts of a larger process.

[0067] The present invention may be a system, method and / or computer program product at any possible level of technical detail integration. The computer program product may include (one or more) computer-readable storage media having computer-readable program instructions thereon, and the computer-readable program instructions are used to cause a processor to perform various aspects of the present invention.

[0068] Computer readable storage medium can be a tangible device that can hold and store instructions used by an instruction execution device. Computer readable storage medium can be, for example, but not limited to, any suitable combination of electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or the aforementioned storage devices. A non-exhaustive list of more specific examples of computer readable storage medium includes the following: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, such as a punch card or a convex structure in a groove with instructions recorded on it, and any suitable combination of the above devices. Computer readable storage medium as used herein should not be interpreted as a temporary signal itself, such as radio waves or other free propagating electromagnetic waves, electromagnetic waves propagated by waveguides or other transmission media (e.g., light pulses by optical fiber cables), or electrical signals transmitted by wires.

[0069] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0070] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of integrated circuits, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages, such as Smalltalk, C++, etc.) and process programming languages ​​(such as "C" programming language or similar programming languages). The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network (including local area network (LAN) or wide area network (WAN)), or can be connected to an external computer (for example, using an Internet service provider through the Internet). In certain embodiments, the electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) can execute the computer-readable program instructions by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit, so as to perform various aspects of the present invention.

[0071] Various aspects of the present invention are described herein with reference to the flow chart and / or block diagram of the method, device (system) and computer program product according to embodiments of the present invention. It will be understood that each frame of the flow chart and / or block diagram and the combination of frames in the flow chart and / or block diagram can be implemented by computer-readable program instructions.

[0072] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed via the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can guide the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0073] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps will be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0074] Flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.In this regard, each frame in the flow chart or block diagram can represent the module, segment or part of instruction, which includes one or more executable instructions for realizing the specified logical function.In some alternative embodiments, the function noted in the frame may not occur in the order noted in the figure.For example, two frames shown continuously can actually be performed substantially simultaneously, or these frames can sometimes be performed in reverse order, depending on the function involved.It will also be noted that the combination of the frames in each frame of the block diagram and / or flow chart illustration and the block diagram and / or flow chart illustration can be realized by a dedicated hardware-based system that performs a specified function or action or performs a combination of special hardware and computer instructions.

[0075] The description of various embodiments of the present invention has been given for the purpose of illustration, but it is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements existing in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

[0076] Although the present invention has been described in terms of specific embodiments, it is contemplated that changes and modifications of the present invention will become apparent to those skilled in the art. Therefore, the appended claims are intended to be interpreted as covering all such changes and modifications that fall within the true spirit and scope of the present disclosure.

Claims

1. A method for maintaining confidentiality of metadata in a decentralized strategy, the method comprising: generating, via the processor, one or more encryption policies associated with the policy creator; generating token metadata associated with the user using the one or more encryption policies; encrypting the token metadata to form encrypted token metadata, wherein the encryption of the token metadata is based at least in part on determining that one or more security restrictions have occurred; sending the one or more encryption policies and the encryption token metadata to a policy evaluator, wherein the policy evaluator evaluates the one or more encryption policies and the encryption token metadata to determine an evaluation result, wherein the evaluation result is based on an evaluation of the one or more encryption policies and the encryption token metadata by the policy evaluator; In response to determining an evaluation result, executing a decision based on the evaluation result; and Returning a response to the user's request, wherein the response is based on the evaluation of the policy evaluator and includes whether the user's request is renderable, wherein rendering of the user's request is based at least in part on one or more specific requirements associated with the user.

2. The method according to claim 1, wherein: Encrypting the token metadata to form encrypted token metadata further comprises: The encrypted token metadata is configured into a JSON Web Token JWT.

3. The method according to claim 2, further comprising: The JWT is obtained by the policy evaluator.

4. The method according to claim 1, wherein: The policy evaluator stores the one or more encryption policies generated by the policy creator.

5. The method according to claim 1, wherein: Sending the one or more encryption policies and the encryption token metadata to the policy evaluator includes: The one or more encrypted policies and the encrypted token metadata are communicated by a resource server to the policy evaluator.

6. The method according to claim 5, wherein: The policy evaluator executes the decision; forwarding the evaluation result to the resource server; and The response is generated via the resource server, wherein the response is returned by the resource server to the user.

7. A system for maintaining confidentiality of metadata in a decentralized strategy, the system comprising: Memory; as well as A processor in communication with the memory, the processor being configured to perform the operations of the method according to any one of claims 1 to 6.

8. A computer program product for maintaining confidentiality of metadata in a decentralized strategy, the computer program product comprising program instructions executable by a processor to cause the processor to perform the operations of the method according to any one of claims 1 to 6.

9. A computer system for maintaining confidentiality of metadata in a decentralized strategy, the computer system comprising means for performing the operations of the method of any one of claims 1 to 6.

Images