Selective Data Disclosure With Verifiable Usage Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively control access and usage of sensitive data shared between organizations, ensuring verifiability and preventing unauthorized dissemination, particularly in scenarios where proprietary information is disclosed under specific conditions.
Innovation Solution
A computer-implemented method and system for verifiable selective disclosure, using a verifiable representation of data with a sealed restricted data portion, where access is controlled by an access management unit that enforces data-usage conditions, preventing transfer of verification proofs to unauthorized recipients.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If verifiable information is disclosed to multiple recipients, then data sharing efficiency is improved, but control over data usage and prevention of unauthorized dissemination deteriorates
Solution Approach 1:
The patent segments the verification proof into multiple parts, distributing different portions to different recipients. Each recipient receives only their authorized portion, which cannot be used to verify data for other recipients. This resolves the contradiction by enabling efficient multi-party data sharing while maintaining granular control over who can verify what data.
Solution Approach 2:
The patent implements local quality by providing each recipient with a customized verification proof tailored to their specific authorization level and data access rights. Rather than providing a universal proof to all recipients, the system generates location-specific, recipient-specific proof portions that enable verification only for authorized data subsets, thus maintaining both sharing efficiency and usage control.
2Reliability
If traditional access control is implemented, then data security is improved, but data verifiability and selective disclosure capability deteriorate
Solution Approach 1:
The patent introduces a trusted intermediary component that issues segmented verification proofs to authorized recipients. This intermediary maintains the security policy definitions and controls proof generation, ensuring that data security requirements are met while still enabling verifiable selective disclosure. The intermediary acts as a mediator between security constraints and verification needs.
3Reliability
If multiple separate verifiable representations are issued for different recipients, then data usage control is improved, but certification costs and system complexity increase
Solution Approach 1:
The patent segments a single verifiable representation into multiple proof portions that can be distributed to different recipients. Rather than creating multiple complete verifiable representations, the system divides one representation's proof components among recipients, reducing certification complexity while maintaining usage control through the segmented proof structure.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Computer-implemented method for providing a verifiable selective disclosure with data-usage control of data (RawD) comprising at least one restricted data portion (RD), comprising the steps of - providing (S1), by a data owner unit (21, 62), a verifiable representation (VR) of data comprising a sealed version (sRD) of the at least one restricted data portion (RD), for access to restricted data to a recipient unit (22, 63), - requesting (S2), by the recipient unit (22, 63), access and a proof for the restricted data portion (RD), from the data owner unit (21, 62), - providing (S3), by the data owner unit (21, 62), a dis-closure information (DI) comprising the sealed version of the restricted data portion (sRD) and the proof to the recipient unit (22, 63), the proof being encrypted by a content key (CDEK), - providing (S4), by the recipient unit (22, 63), information on an execution environment of the recipient unit (22, 63) to an access management unit (23, 61) and requesting the content key (CDEK) for the proof from the access management unit (23, 61), - sending (S5), by the access management unit (23, 61), the content key (CDEK) to the recipient unit (22, 63) if the recipient unit (22, 63) and the provided information on the execution environment complies with at least one data-usage condition of an access policy (AP) for the sealed restricted data portion (sRD), and - receiving (S6) access to the restricted data portion (RD) by decrypting, the proof of the disclosure information (DI) with the content key (CDEK) a by the recipient unit (22, 63), and - verifying (S7) the restricted data portion (RD) with the proof, by the recipient unit (22, 63), wherein the data-usage conditions are configured such that a transfer of the proof to another recipient unit is prevented.