Secret Data Access Control via Blockchain Metadata Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Blockchain systems face challenges in securely storing and managing secret data among multiple parties without compromising their distributed security guarantees.
Innovation Solution
The Secure Document Access Control System (SEDACS) utilizes a blockchain, Secret Store, and content-addressable storage to store metadata and encrypted documents, ensuring that secret keys are distributed among key servers and permissions are enforced by validators, allowing secure access and retrieval of data while maintaining decentralized security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Stability of the object's composition
If secret data is stored on blockchain, then data integrity and immutability are improved, but security is worsened because blockchain data is public and tamper-proof only according to smart contract rules
Solution Approach 1:
The system segments the storage of secret data by storing only metadata (hash, permissions, rules) on the blockchain while placing the actual encrypted data in decentralized storage. This separation allows the blockchain to provide integrity guarantees for metadata while the encrypted data remains secure in distributed storage locations.
Solution Approach 2:
The system introduces an intermediary layer using decentralized storage systems that act as trusted intermediaries between the public blockchain and the secret data. These intermediaries store encrypted data while the blockchain stores only the reference metadata, allowing security without compromising blockchain integrity.
2Reliability
If secret keys are distributed among key servers, then access control and security are improved, but system complexity increases due to distributed key management
Solution Approach 1:
The system segments the secret key into multiple distributed shares stored on different key servers. To access the data, multiple shares must be collected and combined through threshold cryptography, providing fine-grained access control while distributing the complexity across multiple independent components.
Solution Approach 2:
The system creates multiple copies of key shares across different key servers and nodes. These copies are distributed throughout the network and can be combined to reconstruct the full key, providing redundancy and access control without requiring a single centralized key management system.
3Reliability
If documents are encrypted and stored in decentralized storage, then data security is improved, but retrieval complexity increases due to permission verification requirements
Solution Approach 1:
The system performs preliminary action by pre-storing encrypted documents in decentralized storage and pre-verifying user permissions through blockchain smart contracts before retrieval is attempted. This allows the retrieval operation to simply involve checking permissions and receiving the encrypted document, while the complex encryption and permission management are handled in advance.
Solution Approach 2:
The system implements feedback mechanisms where the blockchain continuously tracks user permissions and access history, providing real-time feedback on whether a user is authorized to retrieve specific documents. This automated feedback eliminates manual permission verification complexity and simplifies the retrieval operation to a straightforward permission check.
Data Source
AI summary
The decentralized and distributed architecture of blockchain makes it challenging to store secret data. A Secure Document Access Control System (SEDACS) can store secret data using distributed components without compromising on the distributed security features of the blockchain. SEDACS can include a Secret Store, a blockchain, and a decentralized file system. The blockchain can store rules and permissions for documents that contain the secret data. The Secret Store can generate secret keys that can be used to access the documents. The decentralized file system can store the documents that are encrypted using the secret keys. A user can retrieve the encrypted document provided that the user has the permission to do so. The user can decrypt the encrypted document by decrypting the secret key and using the decrypted secret key to decrypt the document.