Contract Token Authorization for Multi-Party Data Governance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
It is difficult for data non-owners to provide governance or approbate actions on data or metadata owned by a separate entity, such as a data owner, in computing environments like z/Architecture-based systems.
Innovation Solution
A multi-party token-based authorization system is implemented, where a token generation service generates contract tokens that define the conditions of an agreement between a data owner and a data non-owner, allowing the data owner to execute specific actions on the data based on these tokens, with attributes secured from modification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data non-owners want to provide governance or approbate actions on data owned by a separate entity, then data management capability is improved, but system complexity and security risks increase
Solution Approach 1:
The patent introduces a token generation service as an intermediary that creates signed tokens representing governance agreements. These tokens mediate between data non-owners (who need governance capability) and the data storage system (which needs to maintain security). The token contains all necessary authorization information, allowing data non-owners to govern actions without directly accessing or complicating the underlying storage system architecture.
2Adaptability or versatility
If data non-owners are granted direct access to govern data, then governance capability is improved, but security and data protection deteriorate
Solution Approach 1:
The signed token acts as an intermediary credential that carries governance authority without exposing direct access paths to the storage system. The token generation service signs the token with cryptographic keys, creating a secure intermediary layer that verifies authorization without requiring data non-owners to have direct credentials or access to the storage system's security infrastructure.
Solution Approach 2:
Instead of giving data non-owners direct access to governance the data, the system creates a copy of the necessary authorization information embedded within a signed token. This token copy contains all the governance rules and permissions, allowing data non-owners to enforce governance policies without needing to access or modify the actual data or the storage system's access control mechanisms.
3Reliability
If multiple parties need to agree on data management conditions, then governance effectiveness is improved, but the authorization process becomes more complex
Solution Approach 1:
The patent merges multiple governance conditions and agreements from different parties into a single signed token. The token generation service consolidates all the agreed-upon conditions, permissions, and restrictions into one unified credential. This merging process simplifies the authorization workflow, as the storage system only needs to validate one token rather than coordinating multiple separate agreements or access requests.
Solution Approach 2:
The token generation service performs preliminary action by pre-establishing and signing the governance agreement before any data operations occur. All parties' conditions are negotiated and encoded into the token in advance, creating a pre-validated authorization that the storage system can execute without real-time negotiation. This preliminary establishment of terms reduces the complexity of ongoing authorization processes.
Data Source
AI summary
Examples described herein provide a computer-implemented method that includes receiving, at a token generation service, a contract token request from a data non-owner, the contract token request indicating a condition of an agreement between the data non-owner and a data owner that owns data stored in a data storage system. The method further includes generating, by the token generation service, a contract token based on the contract token request, the contract token including an attribute that defines the condition of the agreement between the data non-owner and the data owner. The data storage system enables the data owner to execute an operation on the data based at least in part on the contract token.