Decentralized File Storage Access Control via Client-Side Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed data storage systems, particularly on the Internet, there is no single owner to administer access control, making it challenging to ensure secure data access and transmission, as the security of the transmission path between the client and server is weak, and there is no trusted area to manage access control.
Innovation Solution
A system for secure distributed data storage using cryptographic access control lists, where users declare their access parameters, and encryption keys are managed by clients to control access, ensuring that only authorized users can access and modify files, with public and private keys used for encryption and decryption, and a verification key pair for data integrity, allowing for decentralized and secure storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized server-based access control system is used, then access control can be managed centrally, but the system becomes vulnerable to single point of failure and requires trusted areas that do not exist on the Internet
Solution Approach 1:
The patent divides the centralized access control function into distributed segments. Each client independently manages its own access control lists and encryption keys, eliminating the need for a centralized trusted area. The access control mechanism is segmented across multiple clients rather than concentrated in a single server, making the system more reliable in the decentralized Internet environment.
Solution Approach 2:
Each client is empowered to independently manage access control for files stored on the network. Clients create and maintain their own access control lists, encrypt data with their own keys, and autonomously determine who can access what information. This self-service approach eliminates dependency on centralized administration and trusted areas.
2Reliability
If the transmission path between client and server is secured, then data security is improved, but the complexity of ensuring secure transmission increases in a decentralized network
Solution Approach 1:
The patent applies preliminary encryption at the client side before data is transmitted to the server. Each client encrypts files with their own private keys before storing them on the network, so that data is already secured before transmission begins. This preliminary action eliminates the need for complex continuous security monitoring and verification during transmission.
Solution Approach 2:
The patent introduces cryptographic intermediaries in the form of client-side encryption and access control lists. These cryptographic mechanisms act as intermediaries between the client and server, enabling secure data transmission without requiring the transmission path itself to be actively secured or monitored by a centralized authority.
3Adaptability or versatility
If access control is decentralized to clients, then no trusted area is needed, but clients must manage encryption keys and access control lists independently
Solution Approach 1:
The patent implements self-service by enabling each client to independently create, manage, and enforce access control lists for files. Clients generate their own encryption keys and autonomously determine access permissions without requiring centralized assistance. This self-service capability simplifies the overall system architecture by eliminating trusted areas while distributing security management to individual clients.
Solution Approach 2:
The patent applies local quality by making each client responsible for its own security parameters (encryption keys and access control lists) rather than relying on centralized security management. Each client maintains local copies of access control information and encryption keys, ensuring that security decisions are made locally at each client rather than centrally, which is appropriate for the decentralized Internet environment.
Data Source
AI summary
A system for secure distributed data storage that uses a network, where the system includes a file stored on a plurality of storage elements that are accessible over the network. An access control list associated with the file includes a list of users with read access to the file and a list of users with write access to the file. Data representing contents of the file, metadata associated with the file, data related to functioning of distributed data storage and the access control list is available to users of the network.