Graph-Based Access Control for Blockchain Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In blockchain networks, controlling access to sensitive data stored on a shared ledger while ensuring only permissioned users can access it is challenging due to the immutability of blockchain data and the shared nature of the ledger, which makes protecting assets like sensitive personal information or protected health information difficult.
Innovation Solution
A graph-based access control model is implemented using a directed graph data structure to manage encryption and decryption key relationships, allowing access to encrypted assets by traversing a graph of keys from a start key to a target key, ensuring that only permissioned users can access sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored on a shared blockchain ledger, then data immutability and shared accessibility are achieved, but data protection and access control become difficult
Solution Approach 1:
The patent segments data protection by separating encrypted data from encryption keys, storing them in different locations within the blockchain network. Data is encrypted using multiple keys that are distributed to different participants, so that no single participant can access the complete unencrypted data. This segmentation resolves the contradiction by maintaining data immutability on the shared ledger while protecting data through distributed key management.
Solution Approach 2:
The patent introduces smart contracts as intermediaries that automatically manage key distribution and access control. These smart contracts act as mediators between data storage and data access, enforcing access policies without requiring participants to directly share decryption keys. This intermediary layer protects data while maintaining the shared nature of the blockchain ledger.
2Ease of operation
If encryption keys are shared among participants, then data accessibility is improved, but access control and security are weakened
Solution Approach 1:
The patent implements dynamic key management where encryption keys are not statically shared but are instead distributed and managed through smart contracts that can dynamically control access. Keys can be generated, distributed, revoked, or updated based on changing access requirements without requiring manual intervention. This dynamic approach maintains data accessibility while preserving access control through automated enforcement.
Solution Approach 2:
The patent changes the parameters of key management by using hierarchical key structures and threshold cryptography, where data can be decrypted only when a certain threshold of keys is combined. This parameter change allows flexible control over data accessibility - keys can be distributed widely for ease of access while the threshold requirement maintains security and access control. The system can adapt the threshold parameter based on security requirements.
3Device complexity
If traditional access control methods are used in blockchain, then implementation simplicity is maintained, but data protection effectiveness is reduced
Solution Approach 1:
The patent replaces traditional mechanical access control methods (manual key sharing, administrative approval processes) with cryptographic mechanisms implemented through smart contracts. Instead of relying on organizational policies and manual procedures, the system uses mathematical cryptography and automated contract execution to enforce access control. This substitution maintains implementation simplicity through code-based automation while dramatically improving data protection effectiveness through cryptographic security.
Data Source
AI summary
A method, computer system, and a computer program product for controlling access to an asset in a blockchain network is provided. The present invention may include encrypting the asset using a target encryption key. The present invention may also include storing the encrypted asset on a ledger. The present invention may then include receiving a start encryption key to access the asset. The present invention may further include traversing a graph of keys beginning with the start encryption key across a plurality of nodes and edges until reaching the target encryption key. The present invention may also include allowing access to the asset based on reaching the target encryption key.