Attribute-Based Encryption Directory for Secure Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage and sharing systems often require all-or-nothing data access, leading to inefficiencies as users can only share data entirely or not at all, and face challenges with managing access controls and data accuracy as directories grow.
Innovation Solution
Implementing an anonymous directory that uses attribute-based encryption to securely store and manage data, allowing clients to define access controls based on user identities and attributes, enabling selective data access and sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all-or-nothing data access is implemented, then data security is simplified, but data sharing flexibility deteriorates
Solution Approach 1:
The patent segments data into multiple versions with different access control lists (ACLs), allowing different portions of data to have different access permissions. This enables fine-grained control where specific data versions can be shared with specific user groups while maintaining security, resolving the contradiction between simplified security and flexible sharing.
Solution Approach 2:
The system dynamically manages data versions and their associated ACLs, allowing access permissions to change over time without requiring complete re-encryption or re-sharing of all data. This enables flexible data sharing where access rights can be adjusted granularly while maintaining security boundaries.
2Quantity of substance
If directory size increases to meet storage needs, then data capacity is improved, but data accuracy deteriorates
Solution Approach 1:
The system performs preliminary actions by creating validated data versions before storage, with each version having its own ACL. This allows data to be pre-processed and validated before being added to the growing directory, maintaining accuracy even as capacity increases.
Solution Approach 2:
The patent creates copies of data in different versions with different access permissions. This allows the same data to be stored multiple times with varying ACLs, enabling the directory to grow in capacity while maintaining data accuracy through replicated validated versions.
3Adaptability or versatility
If fine-grained data access control is implemented, then data sharing flexibility is improved, but system complexity increases
Solution Approach 1:
The system uses a universal ACL structure that can be applied to multiple data versions and user groups. This multi-functional approach allows the same access control mechanism to handle various sharing scenarios, reducing overall system complexity despite fine-grained control capabilities.
Solution Approach 2:
The patent introduces an intermediary layer (the versioning system with ACLs) that mediates between data storage and access control requirements. This intermediary manages the complexity of fine-grained access control centrally, allowing flexible data sharing without proportionally increasing overall system complexity.
Data Source
AI summary
Embodiments are directed to securing data using attribute-based encryption. In an embodiment, a computer system encrypts a portion of data with an attribute-based encryption, including associating the encrypted portion of data with one or more encryption attributes. The computer system sends the encrypted portion of data and the one or more encryption attributes to a data store, which stores the first portion of data along with the one or more encryption attributes. The computer system also defines one or more access controls for the portion of data that include an identity of at least one user permitted to access the portion of data. The attribute-based encryption allows the encrypted portion of data to be provided by the data store upon request by the identified user when the request includes one or more search attributes that are relevant to the one or more encryption attributes.