Access Grant Management via Hash-Based Directed Acyclic Graph
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access management systems face challenges in efficiently determining whether access grants have been made, leading to redundant grants, especially in hierarchical data structures with multiple components and grantors/grantees, and require secure management of decryption keys for restricted data and software.
Innovation Solution
The implementation of a hash-based directed acyclic graph (HDAG) data structure for storing and managing access grants, which mirrors the hierarchical arrangement of data objects, uses anchor nodes and entry nodes to ensure secure access and eliminates redundant storage by referencing existing sub-structures, and employs cryptographic hashes to verify access grants.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If traditional access management systems are used to track access grants, then secure access control can be maintained, but the system cannot efficiently determine whether access grants have been made, leading to redundant grants and increased storage requirements
Solution Approach 1:
The system pre-computes and stores cryptographic hashes of access grant data in a hierarchical structure before access requests occur. When an access request is made, the system quickly verifies whether the grant exists by comparing hashes, eliminating the need for time-consuming database queries or complex tracking mechanisms during actual access operations.
Solution Approach 2:
The patent replaces traditional mechanical access tracking mechanisms (databases, logs, and query systems) with a cryptographic hash-based verification system. Instead of storing and querying actual access grant records, the system stores hashes and uses cryptographic verification to determine grant existence, dramatically reducing computational complexity and storage requirements.
2Reliability
If access grants are stored for every possible combination of grantors, grantees, and data objects in a hierarchical file system, then complete access control is maintained, but storage space and bandwidth requirements increase significantly
Solution Approach 1:
The patent merges access grants at multiple hierarchical levels (file, folder, and root directory levels) into a unified hash-based structure. Instead of storing separate access grant records for each file and folder combination, the system combines grants from parent directories with child directory grants, storing only the essential unique grant information in a compact hierarchical format that reduces overall storage requirements while maintaining complete access control.
Solution Approach 2:
The access grant structure is organized in a nested hierarchical manner where access grants at higher levels (root directory, parent folders) contain or reference grants that apply to lower levels (child folders, individual files). This nested structure allows the system to store grants once at the appropriate hierarchical level and automatically inherit them to subordinate levels, eliminating redundant storage of identical grant information across multiple levels.
3Reliability
If the access management system stores detailed access grant information for verification, then access security is maintained, but the verification process becomes slower and more resource-intensive
Solution Approach 1:
The patent extracts the essential verification element from access grant data by storing only cryptographic hashes of grant information rather than the complete grant records. When verification is needed, the system quickly computes the hash of the requested access parameters and compares it against stored hashes, providing secure verification through cryptographic proof without requiring access to or processing of detailed grant information, thereby achieving both high security and fast verification speeds.
Data Source
AI summary
Provided are, among other things, systems, methods, apparatuses and techniques for storing access grants. In one implementation, a blinding factor and access information for accessing a restricted object are obtained; blinded access information is generated for the restricted object based on the access information and the blinding factor; and an anchor node is stored into a data store, with the anchor node being accessible by submission of an identifier, the anchor node at least one of containing or referring to sufficient information to obtain access to the blinding factor and the blinded access information, and the identifier for the anchor node being independent of the blinding factor.