Three-Layer Digital Asset Management System with Local Role Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional role-based access control systems (RBACs) are centralized, leading to inefficiencies in user role identification and permission management, requiring external system queries and increasing management and computing efforts, while also generating excessive control data traffic.
Innovation Solution
A three-layer digital asset management system with a central unit that uses attribute certificates to verify user identities and permissions within the system, allowing for secure and anonymous data transmission, and enabling easier adaptation of security features without increased management or computing efforts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized role-based access control systems are used to manage user permissions, then security control is centralized and manageable, but the system requires external database queries and increases management and computing efforts
Solution Approach 1:
The patent segments the access control system into two parts: a centralized policy definition component and a distributed enforcement component. Each user unit stores local role information and permission data, eliminating the need for continuous external database queries while maintaining centralized security control through initial policy distribution.
Solution Approach 2:
The system performs preliminary action by pre-distributing role information and permission data to user units before access requests occur. This allows user units to make local access decisions without real-time external queries, reducing management overhead and computing efforts during operation.
2Reliability
If centralized RBAC systems are used to store user role information, then permission management is centralized, but requesting units do not know their roles and permissions without external queries
Solution Approach 1:
The system pre-loads role information and permission data into user units during system initialization or policy updates. This preliminary action enables requesting units to immediately access their role and permission information locally without time-consuming external queries during access requests.
Solution Approach 2:
The patent introduces a local cache or storage mechanism in user units that acts as an intermediary between the centralized policy database and the access control logic. This intermediary stores essential role information locally, eliminating the need for frequent external queries and reducing access time.
3Reliability
If access control lists are used to manage user access rights, then authorization can be verified, but the lists are potentially large and require constant network connection to central servers
Solution Approach 1:
The patent segments the large access control lists into distributed role information stored locally in user units. Instead of maintaining one large centralized list that requires constant network access, the system distributes permission data across multiple user units, reducing network traffic and energy consumption while maintaining authorization verification capability.
Solution Approach 2:
The system implements local quality by storing essential authorization data locally in user units rather than requiring constant access to centralized servers. This local storage enables authorization verification to be performed locally without continuous network connection, reducing network energy consumption.
4Reliability
If conventional RBAC systems are used for secure access control, then access rights can be managed, but the systems generate excessive control data traffic
Solution Approach 1:
The patent segments control data by distributing role information and permission data to user units, eliminating the need for continuous transmission of access control lists between central servers and user units. This segmentation significantly reduces control data traffic while maintaining reliable access control.
Solution Approach 2:
The system extracts essential role information and permission data from the centralized access control lists and stores them locally in user units. This extraction eliminates the need for continuous transmission of control data between central servers and user units, reducing control data traffic while maintaining access control functionality.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a three-layer digital asset management system and a method to operate thereof. The invention also relates to a central unit and a service provider unit within the three-layer digital asset management system.