Revocable Object Access via Tokenized ACL
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing online content sharing technologies face challenges in securely managing and controlling access to objects once they are published, as they are vulnerable to hacking and lack efficient permission revocation mechanisms.
Innovation Solution
The implementation of a system that generates a URL with a token for an object, which is registered in an access control list (ACL), allowing users to control access by embedding the URL in content and revoking permissions as needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access control is enforced at the front-end display layer, then access management is simplified, but the system becomes vulnerable to hacking and device compromise
Solution Approach 1:
The patent introduces a back-end access control list (ACL) as an intermediary layer between the stored object and the requesting device. The ACL maintains token permission settings that are enforced by the storage system itself, not just the front-end display layer. This mediator ensures that even if a device is compromised, unauthorized access to objects remains prevented because the security enforcement occurs at the storage layer with cryptographic verification of tokens.
2Adaptability or versatility
If objects are published with broad access, then content sharing is facilitated, but revoking access permissions becomes difficult
Solution Approach 1:
The patent implements dynamic access control through tokens with configurable permission settings stored in the ACL. The owner can modify token permission settings at any time after publication, enabling flexible revocation or modification of access rights. The system dynamically updates access permissions by changing the ACL entries, allowing the owner to restrict access to specific devices, users, or time periods even after the object has been published and shared broadly.
3Reliability
If token permission settings are stored in a centralized ACL, then access control reliability is improved, but system complexity increases
Solution Approach 1:
The patent uses cryptographic token copying where the owner's device creates a token that contains encoded permission settings. This token is copied to requesting devices and stored in the ACL. The ACL stores references to these tokens rather than duplicating entire access control logic across multiple devices. The cryptographic nature of the tokens ensures that copying them does not compromise security, while the centralized ACL management keeps the system architecture manageable.
Data Source
AI summary
Techniques are described to provide revocable object access. In an implementation, a user may provide content and an object (e.g., a picture) to be published with the content. The object is uploaded to a storage location, and a uniform resource locator (URL) that includes a token is generated for the object. The token is registered in an access control list (ACL), and token permission settings in the ACL are utilized to control access to the object. The URL may be embedded in the content. When a viewer requests the content, the object may be retrieved from the storage location using the URL. The user may revoke access to the object by changing the token permission settings in the ACL.