Decentralized File Access Verification Using Multi-Credential Proofs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file access systems using accounts and binding secrets are prone to leakage and impersonation, and managing access permissions is inconvenient due to the need for individual account settings and revocation when users change roles.
Innovation Solution
A decentralized identification system using credentials with issuer and user DIDs, attribute data, and a blockchain-based access control server to verify access conditions through multi-credential proof files, ensuring secure and manageable access permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an account and binding secret mechanism is used for identity verification, then file access security is improved, but the system is prone to leakage and impersonation attacks
Solution Approach 1:
The patent extracts the binding secret from the user's direct control and stores it securely in the cloud infrastructure. The user only retains the account identifier, while the actual authentication credential (binding secret) is managed by the system through secure enrollment and verification processes, eliminating the risk of user-side secret leakage.
Solution Approach 2:
The patent introduces a cloud-based authentication server as an intermediary between the user and the file access system. This mediator handles the secure storage and verification of binding secrets, preventing direct exposure of authentication credentials while maintaining security verification.
2Measurement precision
If individual account settings are required for each user's access permission, then access control precision is improved, but management complexity increases
Solution Approach 1:
The patent implements a universal account mechanism where a single account can dynamically assume different access permissions across multiple files and folders. The account is associated with user attributes that can be programmatically matched against access control rules, allowing one account to serve multiple permission contexts without requiring separate accounts for each file.
Solution Approach 2:
The patent changes the parameter of access control from static account-per-file mapping to dynamic attribute-based permission assignment. User attributes and file access rules are defined with configurable parameters that can be adjusted without creating or deleting accounts, enabling flexible permission management through parameter modification rather than structural changes.
Data Source
AI summary
A system for decentralized identification of a file access permission includes a front-end program and an access control server. The front-end program includes at least one credential. The front-end program extracts attribute data of a corresponding access condition and a definition file identifier (ID) of the credential from the credential based on a check rule message related to a specified file, to form a multi-credential proof file. The access control server obtains an issuer decentralized identifier (DID) and a first public key corresponding to the multi-credential proof file by querying a blockchain for all of the credential definition files corresponding to the multi-credential proof file, confirms that each piece of the attribute data in the multi-credential proof file is correct, and all of the attribute data in the multi-credential proof file meets the access condition, and then grants the front-end program an access permission corresponding to the specified file.