US 11,606,209 B2Granted

Blockchain based access control using time-dependent obfuscation of access tokens

AssigneeLockular Limited

InventorsGary Mawdsley, Dmitry Tishkovsky

Life of this patent

Estimating the term…

Loading patent…

Abstract

There is provided a computer-implemented method for managing third-party access to data, to increase data security and/or privacy. The method comprises receiving, from a third-party computer, a request to access data, wherein the request is indicative of at least one requested operation. A validity of each of the requested operations is determined in dependence on permission data stored in a distributed public ledger. The permissions data defines, for said third-party computer, a set of permissible operations and one or more permissible data attributes associated with each of the set of permissible operations. The request and the validity are logged in the distributed public ledger. For each of the requested operations, if the requested operation is valid, there is created, on the public ledger, an electronic token enabling the third-Valid party computer to obtain access to one or more of the permissible data attributes associated with the requested operation, wherein the electronic token comprises information indicative of a location of the data attributes. A time-dependent transformation is applied to an element of the electronic token, and the electronic token is communicated from the public ledger to the third-party computer.

Claims15

Dependent claims

A computer-implemented method for managing third-party access to data, comprising:

receiving, from a third-party computer, a request to access data, wherein the request is indicative of at least one requested operation;
determining a validity of each of the at least one requested operations indicated in the request in dependence on permission data stored in a distributed public ledger, wherein said permissions data defines, for said third-party computer, a plurality of permissible operations and one or more permissible data attributes associated with each of the plurality of permissible operations, wherein each of the plurality of permissible operations is an operation which may be performed using the data;
logging the request and the validity in the distributed public ledger;
for each of the at least one requested operations, if the requested operation is valid, creating, on the public ledger, an electronic token enabling the third-party computer to obtain access to one or more of the permissible data attributes associated with the requested operation, wherein the electronic token comprises a reverse obfuscation transformation for reversing obfuscation applied to the data attributes and at least one URL indicative of a location of the obfuscated data attributes;
applying a time-dependent transformation to the reverse obfuscation transformation to create an access transformation;
communicating the electronic token from the public ledger to the third-party computer;
following the at least one URL to the location of the obfuscated permissible data attributes;
sending, to the distributed public ledger from the location of the obfuscated permissible data attributes, a query to determine the validity of the URL, wherein determining the validity of the URL comprises checking whether the request was logged in the distributed public ledger;
logging information contained in the URL in the distributed public ledger;
and
if the URL is determined to be valid:
selecting, at the public ledger, a further time-dependent transformation;
communicating the further time-dependent transformation to the location of the obfuscated permissible data attribute;
applying the further time-dependent transformation to the obfuscated permissible data attribute;
and
returning the obfuscated permissible data attribute to the third-party computer.

13 more elements

A computing apparatus comprising a memory and one or more processors, wherein the memory comprises computer readable code which, when executed by the one or more processors, is arranged to perform a method, the method comprising the steps of:

receiving, from a third-party computer, a request to access data, wherein the request is indicative of at least one requested operation;
determining a validity of each of the at least one requested operations indicated in the request in dependence on permission data stored in a distributed public ledger, wherein said permissions data defines, for said third-party computer, a plurality of permissible operations and one or more permissible data attributes associated with each of the plurality of permissible operations, wherein each of the plurality of permissible operations is an operation which may be performed using the data;
logging the request and the validity in the distributed public ledger;
for each of the at least one requested operations, if the requested operation is valid, creating, on the public ledger, an electronic token enabling the third-party computer to obtain access to one or more of the permissible data attributes associated with the requested operation, wherein the electronic token comprises a reverse obfuscation transformation for reversing obfuscation applied to the data attributes and at least one URL indicative of a location of the obfuscated data attributes;
applying a time-dependent transformation to the reverse obfuscation transformation to create an access transformation;
communicating the electronic token from the public ledger to the third-party computer;
following the at least one URL to the location of the obfuscated permissible data attributes;
sending, to the distributed public ledger from the location of the obfuscated permissible data attributes, a query to determine the validity of the URL, wherein determining the validity of the URL comprises checking whether the request was logged in the distributed public ledger;
logging information contained in the URL in the distributed public ledger;
and
if the URL is determined to be valid:
selecting, at the public ledger, a further time-dependent transformation;
communicating the further time-dependent transformation to the location of the obfuscated permissible data attribute;
applying the further time-dependent transformation to the obfuscated permissible data attribute;
and
returning the obfuscated permissible data attribute to the third-party computer.

13 more elements

A non-transitory computer-readable data storage medium storing computer-readable instructions which, when executed by one or more processors, perform a method comprising steps of:

receiving, from a third-party computer, a request to access data, wherein the request is indicative of at least one requested operation;
determining a validity of each of the at least one requested operations indicated in the request in dependence on permission data stored in a distributed public ledger, wherein said permissions data defines, for said third-party computer, a plurality of permissible operations and one or more permissible data attributes associated with each of the plurality of permissible operations, wherein each of the plurality of permissible operations is an operation which may be performed using the data;
logging the request and the validity in the distributed public ledger;
for each of the at least one requested operations, if the requested operation is valid, creating, on the public ledger, an electronic token enabling the third-party computer to obtain access to one or more of the permissible data attributes associated with the requested operation, wherein the electronic token comprises a reverse obfuscation transformation for reversing obfuscation applied to the data attributes and at least one URL indicative of a location of the obfuscated data attributes;
applying a time-dependent transformation to the reverse obfuscation transformation to create an access transformation;
communicating the electronic token from the public ledger to the third-party computer;
following the at least one URL to the location of the obfuscated permissible data attributes;
sending, to the distributed public ledger from the location of the obfuscated permissible data attributes, a query to determine the validity of the URL, wherein determining the validity of the URL comprises checking whether the request was logged in the distributed public ledger;
logging information contained in the URL in the distributed public ledger;
and
if the URL is determined to be valid:
selecting, at the public ledger, a further time-dependent transformation;
communicating the further time-dependent transformation to the location of the obfuscated permissible data attribute;
applying the further time-dependent transformation to the obfuscated permissible data attribute;
and
returning the obfuscated permissible data attribute to the third-party computer.

13 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/054,285Filed 5 Jun 2019
Priority: GB 18092255 Jun 2018
Published: US 2021/0075616 A111 Mar 2021
Granted: 14 Mar 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 9/3213
Involving a third party or a trusted authority: using tickets or tokens, e.g. Kerberos
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
G06F 21/335
Using certificates: for accessing specific resources, e.g. using Kerberos tickets
G06F 21/602
Protecting data: providing cryptographic facilities or services