Cloud Storage Access Policy Dual Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud storage systems face security challenges due to the risk of unauthorized access, as existing methods require multiple third parties for data access and are vulnerable when one of the parties is faulty or compromised, and key management becomes complex with encryption.
Innovation Solution
A method where a client device and a cloud storage device independently evaluate an access policy for requested data, comparing their results to detect any discrepancies, and using cryptographic commitments to enhance security, allowing the system to function without requiring multiple third-party approvals and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple third parties are required to approve data access, then data security is improved, but system complexity and operational difficulty increase
Solution Approach 1:
The patent extracts the access policy evaluation function from the cloud storage device and implements it independently in the client device. This allows the client to autonomously evaluate whether it has permission to access data without requiring manual approval from multiple third parties, while the cloud storage device still performs its own evaluation for security verification. The separation of evaluation responsibilities reduces system complexity while maintaining security through dual verification.
Solution Approach 2:
The access policy is evaluated in advance by both the client device and cloud storage device before actual data access occurs. This preliminary evaluation determines access permissions upfront, eliminating the need for real-time approval from multiple third parties during data retrieval operations, thus simplifying the operational process while maintaining security controls.
2Reliability
If access policy evaluation is performed by both client and cloud storage device, then detection of compromised devices is improved, but processing time increases
Solution Approach 1:
The patent replaces manual or sequential access control mechanisms with an automated dual-evaluation system. Both the client device and cloud storage device independently evaluate the access policy using predefined criteria, and the results are automatically compared. This automated process enables comprehensive security checking without requiring human intervention from multiple third parties, thus reducing the time loss despite the additional evaluation step.
Data Source
AI summary
A method for a client device (1) to request data from a cloud storage device (2) comprises receiving a user request (UR) specifying requested data (RD), producing a client evaluation result (ER1) by evaluating an access policy associated with the requested data, and optionally also producing a client cryptographic commitment (P1) on the client evaluation result (ER1). The user request (UR) and the optional client cryptographic commitment (P1) may be transmitted to the cloud storage device (2), and in response a cloud evaluation result (ER2) may be received from the cloud storage device (2), the cloud evaluation result (ER2) being produced by the cloud storage device (2) by evaluating the access policy associated with the requested data. Then, the client evaluation result (ER1) and the cloud evaluation result (ER2) may be compared, and if the client evaluation result (ER1) fails to match the cloud evaluation result (ER2), a warning message may be produced.