Decentralized Access Control Using Distributed Ledger Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Centralized infrastructure for managing access to secured file systems often results in internal threats, where administrators without authority can access sensitive data due to centralized security management, leading to unauthorized access and data breaches.

Innovation Solution

A decentralized system using cryptographic keys and distributed ledgers to manage access, where each user's authority is recorded in a linear sequence across multiple devices, preventing unauthorized access by ensuring that access granted does not exceed the user's authority, and allowing only authorized users to access encrypted data by verifying their cryptographic user IDs.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If centralized infrastructure is used to manage access control, then ease of operation is improved, but security reliability deteriorates due to internal threats from administrators

Engineering Contradiction:

Improveaccess control managementVSAvoidsecurity

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent segments the centralized access control system into a decentralized architecture where authority is distributed across multiple independent devices. Each device maintains its own copy of the linear sequence and independently verifies user authority, eliminating the single point of failure represented by the centralized administrator. This segmentation ensures that no single entity can compromise the entire system's security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent inverts the traditional access control model by shifting trust from the administrator to the user. Instead of administrators granting access based on their discretion, the system uses cryptographic verification where users prove their authority through digital signatures. The linear sequence automatically enforces access policies without human intervention, reversing the source of potential security breaches.

Inventive Principle:

Principle #13The other way round (Inversion)

2Ease of operation

If administrators are given broad access rights, then ease of operation is improved, but harmful factors increase due to unauthorized data access

Engineering Contradiction:

Improveadministrative accessVSAvoidunauthorized data access

Core Design Contradiction:

Ease of operationVSObject-generated harmful factors

Solution Approach 1:

The patent introduces the linear sequence as an intermediary that mediates between user identity and data access. Rather than administrators directly controlling access, the linear sequence acts as an automated policy enforcement mechanism that verifies user authority and grants access only when policy conditions are met. This intermediary eliminates the need for administrators to have broad access rights while maintaining operational ease.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system implements self-service access control where the linear sequence automatically verifies user authority and enforces access policies without requiring administrator intervention. The cryptographic verification process is self-executing, and the system automatically prevents unauthorized access based on the recorded authority levels, eliminating the security risks associated with human administrators.

Inventive Principle:

Principle #25Self-service

3Reliability

If decentralized verification is implemented, then security reliability is improved, but device complexity increases

Engineering Contradiction:

Improvesecurity verificationVSAvoidverification process

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by pre-recording user authority and access policies in the linear sequence before any access requests occur. The linear sequence is populated with cryptographic proofs of user authority during system initialization or through authorized updates. This preliminary setup allows subsequent access verification to be performed through simple cryptographic checks rather than complex policy evaluation, reducing the complexity burden on individual devices.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces the mechanical complexity of centralized access control management with cryptographic operations. Instead of devices needing to communicate with a central administrator or evaluate complex policy rules, each device independently verifies user signatures against the linear sequence using standard cryptographic algorithms. This substitution of cryptographic mechanisms for administrative processes significantly reduces the operational complexity while maintaining high security reliability.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11874943B2Managing group authority and access to a secured file system in a decentralized environment

Publication Date: 2024.01.16 SPIDEROAK INC

AI summary

Presented here is a system that manages secured file system, and an authority to the secured file system, by granting access only to a user who is authorized to access the file system. The user within the system is identified using a unique key unique to each user. The user's authority is recorded in a linear sequence distributed among multiple devices each of which independently verifies the validity of each block in the linear sequence. The validity of the linear sequence is guaranteed by preventing certain operations from being performed on the linear sequence, such as branching of the linear sequence, deletion, and modification of the blocks within the linear sequence. Prior to adding a new block to the linear sequence, the validity of the block is independently computed by each of the devices.