Document Access Control via On-Demand Key Computation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for controlling access to electronic documents require significant storage and communication resources, especially when dealing with a large number of documents and users, as they need to maintain and manage document-specific access control information for each individual document.
Innovation Solution
A method where a server computes a document-specific key upon request, using information such as a timestamp, policy identification, and user identification, without storing document-specific access control information, and uses seed values to generate unique keys for multiple documents, reducing the need for extensive storage and communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If document-specific access control information is stored for each individual document, then access control reliability is improved, but storage requirements and communication overhead increase significantly
Solution Approach 1:
The patent extracts document-specific access control information from the server's storage burden and embeds it directly into each document as metadata. This includes user identifiers, policy identifiers, and cryptographic keys that are embedded within the document structure itself, allowing the server to verify access rights without storing separate records for each document.
Solution Approach 2:
The patent performs preliminary embedding of access control metadata and cryptographic keys into documents during the document creation or distribution phase. This preliminary action ensures that all necessary access control information is already present in the document when it reaches the client, eliminating the need for the server to store or transmit this information later during access verification.
2Measurement precision
If document-specific access control information is stored for each individual document, then access control precision is improved, but communication overhead increases
Solution Approach 1:
The patent extracts detailed access control information from server storage and embeds it directly into each document. This includes embedding user identifiers, policy identifiers, and cryptographic keys within the document structure, allowing the server to verify access rights without storing or transmitting separate access control records for each document.
Solution Approach 2:
The document itself carries all necessary access control information embedded within its structure. When a client requests access, the document provides its own access control metadata (user identifiers, policy identifiers, cryptographic keys) without requiring the server to retrieve or transmit separate access control data, making the access control verification self-contained.
3Adaptability or versatility
If a database stores records for each document identifying user access permissions, then access control functionality is improved, but device complexity increases
Solution Approach 1:
The patent extracts the access control database functionality from the server system and embeds it directly into each document. Access control metadata including user identifiers, policy identifiers, and cryptographic keys are embedded within the document structure, eliminating the need for a centralized database to store and manage access control records.
Solution Approach 2:
The embedded metadata structure serves multiple functions simultaneously: it acts as an access control list, a cryptographic key store, and a policy reference system. This multi-functional embedded structure replaces the need for separate database tables and complex query mechanisms, simplifying the overall system architecture.
Data Source
AI summary
One exemplary embodiment involves receiving, at a server, a request for a document key for accessing a document on a client device, wherein the request comprises an identity of an access policy and information about the document. The exemplary method further comprises determining, at the server, whether access to the document is permitted according to the access policy. If access to the document is permitted, the exemplary method involves computing, at the server, the document key using the information about the document, wherein the document key is document specific, wherein, prior to the computing of the document key, the document key is not stored for access by the server. The exemplary method further involves responding to the request by providing the document key for use in accessing the document on the client device.