Data Access Consent Verification Without ACL Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ACL-based approaches to data access in large storage systems lead to incorrect policy enforcement and increased processing cost and memory usage due to cross-process data access with varying levels of operation access.
Innovation Solution
Implement a dynamic verification system that stores user and application consent information with each piece of data, allowing the storage system to verify access requests based on tokens associated with the data, reducing the need for ACLs and minimizing processing costs and memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ACL-based approach is used for data access control, then access permissions can be specified, but processing cost and memory usage increase
Solution Approach 1:
The patent extracts the consent verification logic from the traditional ACL-based access control system. Instead of relying on complex ACL checks for every data access request, the system extracts and stores consent information directly with each data object in the data lake. This extraction simplifies the access control mechanism by allowing direct verification of consent status without requiring full ACL processing, thereby reducing processing cost while maintaining access control accuracy.
Solution Approach 2:
The patent segments the access control information into two parts: (1) ACL-based permissions that define what operations are allowed, and (2) consent information that defines whether access is permitted. By segmenting these concerns and storing consent information directly with data objects, the system can quickly filter out unauthorized access requests based on consent status before performing more expensive ACL verification, thus reducing overall processing cost.
2Reliability
If ACL-based approach is used for data access control, then access permissions can be specified, but memory usage increases
Solution Approach 1:
The patent extracts consent information from the centralized ACL structure and embeds it directly with each data object. This extraction eliminates the need to maintain and query large ACL data structures for every access request, significantly reducing memory usage. The consent information is stored as a compact attribute alongside the data object, requiring minimal additional memory while preserving access control accuracy.
Solution Approach 2:
The patent creates a simplified copy of the essential access control information (consent status) and stores it directly with each data object. Instead of maintaining full ACL entries in memory for every data access check, the system uses this compact copied information for quick verification. This copying approach reduces memory usage by storing only the critical consent decision rather than complete ACL permission sets.
3Productivity
If dynamic verification of user consent is implemented, then processing cost is reduced, but system complexity increases
Solution Approach 1:
The patent performs preliminary action by obtaining and storing user consent information at the time of data creation or upload, rather than verifying complex ACL permissions at the time of each access request. This preliminary capture of consent status and its storage with the data object simplifies the access control process, reducing processing cost during data access operations while the initial consent management handles the complexity.
Solution Approach 2:
The patent implements self-service by enabling data objects to carry their own consent information, allowing the system to automatically verify access permissions without requiring complex centralized ACL management for every request. The consent information embedded in data objects enables self-verification, reducing the need for complex access control processing while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Aspects of the disclosure are directed to dynamic verification of user consent for data access. Each piece of data stored in a database includes information associated with a user and which applications that user consented to accessing the respective piece of data. As part of online access or offline access, an application may request access to a piece of data associated with a user. In response to the access request, the database verifies whether that application has consent to access the piece of data using the information associated with which applications a user consented to accessing the piece of data. If the information includes a consent, the database allows access. If the information includes a denial or does not include a consent, the database denies access. The dynamic verification allows for access enforcement with lower process cost and memory usage, as consent information is added to the data itself and an access control list is no longer needed.