Owner-Controlled Access Control for Released Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In collaborative digital environments, there is a loss of control over shared data as it traverses across organizational boundaries, posing security risks due to the inability to enforce access control and maintain data confidentiality.
Innovation Solution
A distributed access control enforcement approach using software agents and data encryption techniques, where workflow objects are validated and access is managed through validation tokens and access keys, ensuring that only authorized users can access and modify restricted content based on predefined policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is released from one domain to another domain, then data sharing and collaboration are enabled, but control over the data is lost and security risks increase
Solution Approach 1:
The patent introduces validation tokens and access keys as intermediary cryptographic mechanisms that enable data sharing while maintaining owner control. The validation token acts as a mediator between the data owner and data user, allowing the owner to grant temporary, controlled access without relinquishing ownership or control rights.
Solution Approach 2:
The system performs preliminary actions by generating validation tokens and access keys before data release. These cryptographic credentials are prepared in advance with embedded control policies, enabling the data owner to pre-establish control rules that will automatically enforce themselves during data usage without requiring continuous monitoring.
2Reliability
If traditional access control is used, then data confidentiality is protected, but the data owner cannot perform operations on the data after release
Solution Approach 1:
The patent implements dynamic access control where the data owner can perform operations on released data through the validation token mechanism. The system transitions from static access control to dynamic control, allowing the owner to issue new validation tokens, revoke access, or modify access policies even after data has been released to other domains.
3Productivity
If data is shared across multiple domains, then collaboration efficiency is improved, but security management complexity increases
Solution Approach 1:
The validation token mechanism serves multiple functions simultaneously: it acts as an access key, a control policy carrier, a revocation mechanism, and an audit trail. This multi-functional approach consolidates multiple security management tasks into a single cryptographic artifact, reducing the overall complexity of cross-domain security management while enabling efficient collaboration.
Data Source
AI summary
Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for receiving, from a computing device used by an authenticated user, a validation request, the validation request including a first hash value and a first validation token, the first hash value being generated based on restricted content of a workflow object and the first validation token being associated with a first state of the workflow object, and determining that the authenticated user is authorized to request validation of the workflow object and, in response: decrypting the validation token to provide a second hash value, and determining that the second hash value is equal to both the first hash value and a third hash value and, in response, transmitting a validation response to the computing device, the validation response indicating that the workflow object is valid.