Usage Policy Enforcement via Signature Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Providers of source data face challenges in controlling and verifying the enforcement of usage policies beyond the first distribution step, as original policies become invalid when new data is derived, and there is no way to ensure the origin and integrity of usage policies in subsequent data processing and receiving nodes.

Innovation Solution

A data processing node receives source data and its associated usage policy along with a source signature, generates new data while adhering to the usage policy, and calculates a new signature that ties to both the original and new data policies, ensuring that the usage policy of the source data is enforced and verified throughout the data distribution path.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If usage policy is applied at the first distribution step, then access control for source data is achieved, but the policy becomes invalid when new data is derived and cannot be enforced in subsequent steps

Engineering Contradiction:

Improveusage policy enforcementVSAvoidpolicy validity period

Core Design Contradiction:

ReliabilityVSDuration of action of stationary object

Solution Approach 1:

The source node attaches the usage policy to the source data before distribution. The data processing node then carries forward this pre-attached policy through subsequent data processing steps, ensuring the policy remains valid and enforceable throughout the entire data lifecycle rather than expiring after the first distribution step.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The data processing node acts as an intermediary that receives the usage policy from the source node and forwards it to subsequent nodes. This intermediary mechanism ensures the policy is transmitted and maintained through multiple distribution steps, preventing policy invalidation during data processing transformations.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If usage policy is manually copied at each distribution step, then policy enforcement is maintained, but the origin and integrity of the policy cannot be verified

Engineering Contradiction:

Improvepolicy enforcementVSAvoidpolicy origin verification

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The system implements a verification mechanism where the data processing node checks whether the received usage policy matches the expected policy associated with the source data. This feedback loop allows verification of policy integrity and origin at each distribution step, preventing manipulation while maintaining enforcement.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The manual copying process is replaced with an automated verification system that uses policy comparison mechanisms. Instead of manually copying and trusting policies, the system automatically verifies policy integrity through comparison operations, ensuring both enforcement and origin verification without manual intervention.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Adaptability or versatility

If multiple parties are permitted to access source data, then data utilization is enhanced, but control and verification of policy enforcement becomes difficult

Engineering Contradiction:

Improvedata access flexibilityVSAvoidpolicy control mechanism

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The usage policy mechanism is designed to be universally applicable across multiple data processing nodes and distribution steps. The same policy attachment and verification mechanism works throughout the entire data lifecycle, enabling multiple parties to access data while maintaining consistent control without requiring different mechanisms for each access point.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system enables self-verification of policy enforcement at each node. The data processing node automatically compares the received policy with the expected policy and can detect inconsistencies or violations without requiring central authorization for each access event, simplifying control while maintaining versatility.

Inventive Principle:

Principle #25Self-service

Data Source

PatentEP2909784B1Methods and nodes for handling usage policy

Publication Date: 2021.02.24 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

Figure 1~2
Figure 3
Figure 4

AI summary

Methods and nodes (300a, 300b, 302) for handling a usage policy (P1.P2) pertaining to source data (D1,D2) generated by a source node (300a, 300b). The usage policy dictates permission to access and use the source data. The source node calculates a signature (Sig) based on an identification (id_D) of the source data and the usage policy (P) of the source data, and provides the source data, its usage policy and the calculated signature to a data processing node (302). The data processing node then generates new data (D3) based on the source data, and calculates a new signature (Sig3) based on an identification (ldj_)3) of the new data and at least one of: a new usage policy (P3) pertaining to the generated new data, and the usage policy (P1, P2) of the source data. The data processing node finally provides the new data, the usage policies (P1, P2, P3) and the signatures (Sig1, Sig2, Sig3) to a data receiving node (304) which is thereby enabled to verify and comply with the provided usage policies based on the respective associated signatures.