Embedded Consent Tokens for Low-Overhead Data Access Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ACL-based approaches for data access in large storage systems lead to incorrect policy enforcement and increased processing cost and memory usage due to cross-process use with different levels of operation access.
Innovation Solution
A storage system that stores user and application consent information with each piece of data, allowing dynamic verification of access requests through tokens, reducing the need for ACLs and minimizing processing cost and memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ACL-based approach is used for data access control, then access permission management is achieved, but processing cost and memory usage increase significantly
Solution Approach 1:
The patent extracts the access control information from the traditional ACL structure and embeds it directly into the data storage system. Each data record includes a consent token that contains the access permission information, eliminating the need for separate ACL structures and reducing processing overhead.
Solution Approach 2:
The patent merges the access control list functionality with the data storage structure. The consent token is integrated into each data record, combining the data storage and access control functions into a single unified structure, thereby reducing memory usage and processing cost.
2Reliability
If ACL-based approach is used for data access control, then access permission management is achieved, but memory usage increases significantly
Solution Approach 1:
The patent extracts the access control information from the traditional ACL structure and embeds it directly into the data storage system. Each data record includes a consent token that contains the access permission information, eliminating the need for separate ACL structures and reducing memory usage.
Solution Approach 2:
The patent merges the access control list functionality with the data storage structure. The consent token is integrated into each data record, combining the data storage and access control functions into a single unified structure, thereby reducing memory usage.
3Quantity of substance
If traditional data storage approach is used, then data storage is achieved, but user consent verification becomes complex and costly
Solution Approach 1:
The patent performs preliminary action by pre-storing the user consent information and application token data directly in the data records during the data storage phase. This preliminary preparation eliminates the need for complex real-time verification processes, simplifying the consent verification complexity.
Solution Approach 2:
The data records themselves provide the consent verification functionality through the integrated consent token. The system uses self-service by allowing the data structure itself to carry and provide the access control information, eliminating the need for external complex verification mechanisms.
Data Source
AI summary
Aspects of the disclosure are directed to dynamic verification of user consent for data access. Each piece of data stored in a database includes information associated with a user and which applications that user consented to accessing the respective piece of data. As part of online access or offline access, an application may request access to a piece of data associated with a user. In response to the access request, the database verifies whether that application has consent to access the piece of data using the information associated with which applications a user consented to accessing the piece of data. If the information includes a consent, the database allows access. If the information includes a denial or does not include a consent, the database denies access. The dynamic verification allows for access enforcement with lower process cost and memory usage, as consent information is added to the data itself and an access control list is no longer needed.