Decentralized Access Control for Shared Cloud Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cloud storage platforms enforce centralized file ownership, making it difficult for multiple users to collaborate on shared data without a single administrator, and existing access control methods are not suitable for decentralized systems, as they require a centralized administrator or rely on unilateral decision-making.
Innovation Solution
A method and system for enforcing access control policies in a decentralized manner using a cloud storage API, employing secure file dispersal and collusion-resistant delegation, where each user can apply their individual access control policies and share encrypted data across multiple accounts, using Shamir secret sharing and all-or-nothing encryption with fast-fourier transform, allowing flexible and secure access management without a central administrator.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If centralized file ownership is enforced, then access control decisions can be made unilaterally by a single owner, but multiple users cannot collaborate effectively on shared data without a single administrator
Solution Approach 1:
The patent segments file ownership and access control authority into multiple independent owner accounts rather than concentrating it in a single administrator. Each owner can independently manage their own data and apply their individual access policies, allowing collaborative access without requiring a centralized decision-maker. This segmentation resolves the contradiction by enabling both unilateral decision-making capability (at the individual owner level) and multi-user collaboration (at the system level).
Solution Approach 2:
The patent introduces a new dimension of access control by implementing a threshold-based mechanism where access rights are determined by the number of distinct owners whose policies are satisfied, rather than by a single centralized authority. This dimensional change allows the system to simultaneously support individual owner autonomy and collective collaboration requirements.
2Ease of operation
If a single trusted user is designated to evaluate access policies, then access decisions can be centralized, but the trusted user cannot be held accountable for collecting and correctly evaluating access policies of other owners
Solution Approach 1:
The patent segments the access policy evaluation function across multiple independent owner accounts rather than concentrating it in a single trusted user. Each owner independently evaluates and enforces their own access policies on their data portions, eliminating the accountability problem while maintaining operational simplicity. The system automatically aggregates these decentralized decisions to determine overall access rights.
Solution Approach 2:
Each owner independently performs access policy evaluation and enforcement on their own data without requiring another user to act as a trusted intermediary. This self-service approach resolves the accountability issue by making each owner responsible for their own access control decisions while the system coordinates these decisions automatically.
3Reliability
If conventional access control methods are used, then a centralized administrator is required, but decentralized shared ownership cannot be achieved
Solution Approach 1:
The patent segments both data storage and access control authority across multiple independent owner accounts. Each owner maintains control over their data portions and applies their access policies independently, while the system aggregates these segmented controls to provide overall access enforcement. This enables decentralized shared ownership while maintaining reliable access control.
Solution Approach 2:
The patent introduces a threshold dimension to access control where access rights are determined by satisfying policies from a sufficient number of distinct owners rather than requiring centralized approval. This dimensional change enables the system to support decentralized ownership structures while maintaining security through the threshold mechanism.
4Adaptability or versatility
If file access is shared among multiple owners, then collaboration is enabled, but security against adversaries becomes more complex
Solution Approach 1:
The patent implements a threshold mechanism where access requires satisfying policies from a sufficient number of owners rather than all owners. This partial action approach simplifies the system by not requiring unanimous agreement, while still providing security through the threshold requirement. The system handles the complexity of multiple owners by using this streamlined threshold evaluation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for enforcing access control policies on data owned by a plurality of users includes evaluating the access control policies of users, applying a collusion resistant sharing scheme for generating key shares of an encryption key and delegating the key shares to one or more designated users based on a result of the evaluation. The data is securely dispersed by applying an encryption scheme on all parts of the data to be encrypted to produce encrypted data shares. The encryption scheme is provided such that for decryption of the encrypted data, the encryption key and at least a predetermined number of data shares are provided. Each data share is delegated to one or more designated users, and the data shares and the key shares are distributed to the respective designated users.