Blockchain Access Policies for Shared Enterprise Data Segments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing blockchain implementations face increased complexity and resource intensity due to the need for separate blockchains or channels for each customer or ISP, complicating data sharing and incident response processes.
Innovation Solution
Implement a mechanism for selective access control to portions of a blockchain, allowing different groups of client devices to access specific records through access policies applied at the chaincode level, enabling a single channel for multiple enterprises or ISPs with enforced access control using pre-transaction logic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate blockchains or channels are implemented for each customer or ISP, then data privacy and access control are improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent merges multiple separate blockchains into a single shared blockchain infrastructure. Instead of maintaining distinct blockchain instances for each customer or ISP, the system allows multiple parties to share a common blockchain while enforcing access control policies at the application layer through smart contracts and chaincode, thereby reducing system complexity while maintaining data privacy
Solution Approach 2:
The patent introduces access control mechanisms and policy enforcement layers as intermediaries between the shared blockchain infrastructure and individual customers/ISPs. These intermediaries manage permissions and restrict access to specific data portions without requiring separate blockchain instances, thus resolving the contradiction between privacy protection and system simplicity
2Reliability
If separate blockchains or channels are implemented for each customer or ISP, then access control is improved, but resource intensity and maintenance overhead increase
Solution Approach 1:
The patent combines multiple isolated blockchain systems into a single shared infrastructure, reducing the total computational resources, storage capacity, and energy consumption required to maintain separate blockchain instances. Access control is achieved through policy-based mechanisms rather than physical isolation
Solution Approach 2:
The shared blockchain infrastructure is designed to serve multiple customers and ISPs simultaneously with universal access control policies. The system can dynamically adjust permissions and access levels for different parties without requiring dedicated resources for each, optimizing resource utilization while maintaining security
3Reliability
If separate blockchains or channels are implemented for each customer or ISP, then data isolation is improved, but data sharing and incident response efficiency decrease
Solution Approach 1:
The patent segments the blockchain data into different portions or namespaces that can be selectively accessed by different customers or ISPs. Rather than complete isolation, the system allows fine-grained control over which data portions are visible to which parties, enabling both isolation and efficient sharing through a unified interface
Solution Approach 2:
The patent introduces policy enforcement mechanisms and access control intermediaries that mediate between the shared blockchain and individual parties. These intermediaries enable efficient data sharing and coordinated incident response by managing permissions dynamically without requiring separate blockchain infrastructures, thus improving productivity while maintaining data isolation
Data Source
AI summary
A system described herein may maintain a blockchain that includes a plurality of records, where a particular record of the blockchain includes a set of access policies, and an access policy identifier. The system may receive a request to perform a set of operations, determine that the requested set of operations is associated with the access policy identifier, whether the request meets the set of access policies included in the particular record with which the access policy identifier is associated, and selectively perform or forgo performing the requested set of operations based on the determination of whether the request meets the set of access policies, including performing the requested set of operations when determining that the request meets the set of access policies, and forgoing performing the requested set of operations when determining that the request does not meet the set of access policies.