Immutable Ledger Granular Access via Time-Indexed Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control mechanisms for immutable distributed ledger technologies, such as blockchain, are immature and often implement access on an all-or-nothing basis, lacking granular control and security, particularly when granting third-party access to data.
Innovation Solution
A method that allows data owners to encrypt data on an immutable ledger with time-indexed encryption, enabling granular access control by providing specific decryption keys to third parties for specific data elements at particular moments or within specified time ranges, thereby avoiding central application layer vulnerabilities and ensuring secure, direct access to the ledger.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single symmetric key is generated for each data-providing party to enable access to their data on the immutable ledger, then access control is simplified, but all of the party's records become accessible to anyone possessing the key, losing granular control over specific data elements
Solution Approach 1:
The patent segments the single symmetric key into multiple unique symmetric keys, with each key corresponding to a specific data element or record. This segmentation enables granular access control where different third parties can be granted access to specific keys and thus specific data elements, rather than providing one key that unlocks all data from a data-providing party.
Solution Approach 2:
The patent applies local quality by assigning different security properties to different data elements through unique symmetric keys. Each data element can have its own encryption key, allowing the data owner to control access on a per-element basis, giving different levels of access protection to different parts of the data structure.
2Device complexity
If access control is implemented at the application layer to enable selective data access, then granular control over specific data elements is achieved, but the security is weaker than the underlying data encryption
Solution Approach 1:
The patent introduces an intermediary mechanism in the form of unique symmetric keys that bridge the gap between application-layer access control requirements and cryptographic security. These keys act as mediators that enable granular access control while maintaining cryptographic security, as the keys themselves are the security mechanism rather than an additional layer on top of encryption.
Solution Approach 2:
The patent performs preliminary action by generating unique symmetric keys for each data element at the time of data creation or before access is needed. This preliminary key generation and distribution establishes the access control framework in advance, enabling secure granular access without requiring complex application-layer logic during data retrieval operations.
3Reliability
If periodic refreshing of the symmetric key is implemented to mitigate unauthorized access, then security is improved over time, but the party has multiple time-indexed keys and cannot restrict access to specific data elements within a time period
Solution Approach 1:
The patent segments both the temporal and data element dimensions of access control by creating unique symmetric keys for each data element that can have their own time-based access policies. This allows restriction of access to specific data elements within time periods, rather than having to refresh a single key that controls all data.
Solution Approach 2:
The patent implements dynamic access control where the validity and accessibility of each unique symmetric key can be independently managed over time. This allows the system to dynamically control which data elements are accessible at which times, providing flexible time-based access restrictions at the data element level rather than applying uniform time restrictions to all data.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A method and system that enables a data owner to write data in an encrypted manner to an immutable ledger, and yet still be able to grant read access to specific data elements, as they were written at particular moments in time, to a requesting party. Examples therefore provide a process for encryption of data onto an immutable ledger in a time indexed manner, together with a process by which a third party can request access to the data stored in the immutable ledger from the data owner, and the data owner can provide them with certain decryption keys that allow the third party to read the data directly from the immutable ledger, again based on time-indexed queries. The data the third party can read is restricted to specific elements only of the data written, and further restricted to within a time range or to a specific point in time.