Distributed Ledger Entitlement Management

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Managing user entitlements across distributed computing resources is challenging due to inconsistencies between central and local resource access managers, leading to difficulties in organizing and controlling access rights.

Innovation Solution

A distributed electronic ledger system, such as a blockchain, is used to store and validate entitlement data records, ensuring that only authorized changes are made and maintaining an immutable record of approved entitlements, which are then synchronized with local entitlement databases to maintain consistency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a centralized entitlement management system is used, then ease of operation is improved, but reliability deteriorates due to inconsistencies between central and local resource access managers

Engineering Contradiction:

Improveease of managing user entitlementsVSAvoidconsistency of entitlement data

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent divides the centralized entitlement management system into multiple distributed resource access managers that each maintain local copies of entitlement data. This segmentation allows each manager to operate independently while maintaining consistency through the distributed ledger, resolving the contradiction between ease of operation and reliability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The distributed ledger acts as an intermediary between the central entitlement database and local resource access managers. It mediates data synchronization and consistency verification, ensuring that all managers have access to the same authoritative entitlement information without requiring direct communication between each manager and the central database.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If local resource access managers maintain independent entitlement databases, then ease of operation is improved, but discrepancies and security risks increase

Engineering Contradiction:

Improveautonomy of local resource access managersVSAvoidunauthorized access and discrepancies

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system implements feedback mechanisms where local resource access managers periodically verify their local entitlement databases against the distributed ledger. This feedback loop detects and corrects discrepancies, ensuring that autonomous local managers maintain consistent and secure entitlement data without centralized direct control.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The distributed ledger pre-establishes an immutable record of authorized entitlements before local managers distribute this information to their systems. This preliminary action ensures that all subsequent local operations are based on pre-validated authority, preventing unauthorized access and maintaining security while allowing local autonomy.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If entitlement data is synchronized across distributed systems, then reliability is improved, but device complexity increases

Engineering Contradiction:

Improveconsistency of entitlement recordsVSAvoidcomplexity of distributed ledger system

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The distributed ledger implements a universal data structure and consensus mechanism that can be adopted by any resource access manager in the distributed system. This multi-functionality allows the same protocol to handle synchronization, verification, and conflict resolution across all nodes, reducing the need for manager-specific complexity while maintaining reliability.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS10986097B2System for using a distributed ledger to manage user entitlements to computing resources

Publication Date: 2021.04.20 BANK OF AMERICA CORP

AI summary

An access control system may include one or more computer processors; a memory, wherein the memory comprises an entitlement database of a resource access manager; a network communication device; and an access control module stored in the memory, executable by the one or more computer processors. The access control module may be configured to: perform the steps of: receiving a request to add one or more entitlement data records to a distributed electronic ledger; validating the one or more entitlement data records; appending the one or more entitlement data records to the distributed electronic ledger; and verifying a first entitlement data record stored in the entitlement database by comparing the first entitlement data record with a first corresponding entitlement data record stored in the distributed electronic ledger, wherein the first entitlement data record and first corresponding entitlement data record are both associated with a first user.