Encrypted Knowledge Graph Decentralized Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized management of access rights in knowledge graphs is cumbersome and inhibits sharing of knowledge between departments and organizations without a central authority, delaying access management and requiring super-user administrators.
Innovation Solution
A method and system that splits knowledge graphs into subgraphs, encrypts them with user-specific asymmetric keys, and generates private summary graphs, allowing decentralized control and access management through collaboration graphs and public summary graphs, enabling users to grant and revoke access directly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a central authority is used to manage access rights, then access control can be provided, but it delays maintenance activities and access rights management
Solution Approach 1:
The patent divides the centralized access control system into distributed components. Each knowledge subgraph is encrypted with its own key pair, and access rights are managed locally by content owners rather than through a central authority. This segmentation eliminates the bottleneck of centralized management and enables parallel, independent access control decisions across multiple entities.
Solution Approach 2:
The patent implements self-service access control where content owners automatically manage their own access rights through cryptographic key pairs. Each entity can grant or revoke access to their knowledge subgraphs independently without requiring intervention from a central authority, enabling autonomous access management that eliminates delays associated with centralized approval processes.
2Reliability
If a central authority maintains all credentials, then access control is provided, but it requires complete trust and gives complete access to all information
Solution Approach 1:
The patent segments the credential management system so that each knowledge subgraph has its own encrypted key pair stored locally with the content owner. This eliminates the need for a central authority to maintain all credentials, as each entity independently manages its own cryptographic keys. The segmentation of credentials into distributed, encrypted units removes the trust bottleneck while maintaining access control reliability.
Solution Approach 2:
The patent introduces cryptographic key pairs as intermediaries between content owners and access seekers. Instead of requiring direct trust in a central authority, the asymmetric encryption system acts as an intermediary that mathematically guarantees secure access control. The public key enables verification of access rights without exposing private credentials, eliminating the need for complete trust in any single entity.
3Adaptability or versatility
If knowledge graphs are stored centrally, then collaboration is facilitated, but substantial storage and computing capacities are required
Solution Approach 1:
The patent segments the centralized knowledge graph into distributed knowledge subgraphs managed by different entities. Each subgraph is encrypted and stored locally with the content owner, eliminating the need for a single centralized storage system. This segmentation enables collaboration through selective sharing of encrypted subgraphs while reducing the storage burden on any single system.
Solution Approach 2:
The patent implements a summary graph that contains encrypted references and metadata about knowledge subgraphs without storing the full subgraph data. This copying approach allows entities to access and collaborate on knowledge subgraphs through the summary graph while the actual data remains distributed and encrypted with content owners, significantly reducing storage requirements while maintaining collaboration capabilities.
Data Source
AI summary
A computer-implemented method for managing access rights to a knowledge graph is provided. The method comprises splitting, for each user system, its respective portion of the knowledge graph into a plurality of knowledge subgraphs, encrypting each of the knowledge subgraphs, and generating a plurality of private summary graphs. The method also comprises maintaining a collaboration graph comprising one vertex per user system and edges representing collaborations between the users, mapping all private subgraphs of all user systems to one public summary graph, each vertex of the public summary graph comprises less data than the related vertex of the related private summary graphs and wherein none of the vertices of the summary graph comprises any encryption or decryption key, and granting access to a selected knowledge subgraph from a first user system to a second user system.