Verifiable MAC Labels for Distributed Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Mandatory Access Control (MAC) systems face challenges in managing and maintaining labels and policies due to the complexity of interactions between numerous subjects and objects, especially in multilevel security systems and distributed computer environments, leading to performance issues and trustworthiness concerns.

Innovation Solution

The implementation of verifiable mandatory access control (MAC) labels using decentralized identifiers (DIDs) and distributed ledger technology, where labels are digitally signed and machine-readable, allowing for secure and decentralized management of access control policies and authentication mechanisms.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional MAC systems are applied to modern distributed computing environments, then access control functionality is provided, but trustworthiness of externally supplied labels becomes suspect and system complexity increases

Engineering Contradiction:

Improvetrustworthiness of security labelsVSAvoidsystem complexity in distributed environments

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces verifiable credentials as intermediary objects that carry security labels between distributed systems. These credentials are digitally signed by trusted issuers, acting as mediators that transport trust information without requiring direct trust between remote systems. The credential format includes structured data about subjects, objects, and access policies that can be verified independently.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces traditional mechanical MAC label management with cryptographic verification mechanisms. Instead of relying on complex trust relationships between distributed systems, the system uses digital signatures and verifiable credentials to establish trust. The access control decision process substitutes complex policy evaluation with straightforward verification of credential validity and attributes.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If MAC labels are managed in multilevel security systems, then access control is enforced, but the sheer number of objects and subjects creates unacceptable performance drag

Engineering Contradiction:

Improveaccess control enforcementVSAvoidsystem performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent extracts the heavy computational burden of MAC label management from the access control decision process. By pre-verifying credentials and their attributes before access requests, the system separates the complex verification work from the real-time access decisions. Only validated credential attributes are considered during access control, significantly reducing processing time.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent performs preliminary verification of credential validity, issuer trustworthiness, and attribute consistency before access control decisions are made. This advance preparation ensures that when access requests arrive, the system only needs to perform simple attribute comparison rather than complete re-verification, dramatically improving response time.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If verifiable credentials with digital signatures are used, then trustworthiness and auditability are improved, but computational overhead for verification increases

Engineering Contradiction:

Improveauditability of access controlVSAvoidcomputational overhead for credential verification

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent applies partial verification by only checking the necessary cryptographic elements required for access control decisions. Rather than verifying every aspect of every credential, the system performs selective verification focused on validating signatures and extracting only the attributes needed for access control policy evaluation, reducing unnecessary computational overhead.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11693948B2Verifiable labels for mandatory access control

Publication Date: 2023.07.04 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

A computer-implemented method and a computer program product for enforcing verifiable mandatory access control (MAC) labels, and a data processing system. One embodiment may comprise receiving, from an entity, a first verifiable MAC label associated with an object, receiving, from the entity, a second verifiable MAC label associated with a subject requesting to access the object, and determining whether to grant, to the subject, access to the object responsive to the request based on comparing the first verifiable MAC label associated with the object and the second verifiable MAC label associated with the subject to a verifiable MAC policy. Each of the first verifiable MAC label, the second verifiable MAC label, and the verifiable MAC policy in some embodiments may be formatted as a verifiable credential that is machine readable and digitally signed.