Permissions using blockchain

Patent metadata

Field	Value
Publication number	US-10812490-B2
Application number	US-201916432012-A
Country	US
Kind code	B2
Filing date	Jun 5, 2019
Priority date	Feb 24, 2017
Publication date	Oct 20, 2020
Grant date	Oct 20, 2020

Abstract

A network device receives a smart contract for permissions to access a service, wherein the smart contract is in an initial block for authorizations in a shared ledger. The network device receives, from an authorization server device, an update to the shared ledger, wherein the update is a proposed block in the shared ledger requiring validation. The network device stores, in a local memory, a copy of the shared ledger with the update, when the update is validated by the distributed consensus network. The network device receives, from a client device, an item request for an item associated with the service, wherein the item request includes a client identifier. The network device identifies if there is match of the client identifier and the item in the copy of the shared ledger and sends, to the client device, the item when there is match of the client identifier and the item.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a network device in a distributed network, a first set of permissions with parameters to access a service, wherein the first set of permissions is in a first block of a shared ledger;
receiving, by the network device and from an authorization service device, an update to the shared ledger, wherein the update is in a second block of the shared ledger, the second block comprising a second set of permissions with conditions for the parameters;
storing, by the network device and in a local memory, the second block as part of an updated shared ledger, when the second block is validated by the distributed network;
receiving, by the network device and from a client device, a request to access the service, wherein the request includes client identification; and
providing access to the service, by the network device and to the client device, when there is a match of the client identification and the service in the request with the parameters and conditions in the updated shared ledger.

2. The method of claim 1 , wherein the shared ledger includes a read-only application binary interface (ABI) for use by the authorization service device to audit fields in the shared ledger.

3. The method of claim 1 , further comprising:
receiving human-readable input to define the first set of permissions; and
converting the human-readable input to code.

4. The method of claim 1 , further comprising:
converting the second set of permissions from human-readable input to code.

5. The method of claim 1 , wherein the update includes information specifying one or more of a new item for the service, a new user for the service, or a new permission parameter for an item.

6. The method of claim 1 , wherein the shared ledger identifies items and users that have permission to access the items.

7. The method of claim 1 , wherein the shared ledger includes a read-only application binary interface (ABI) for use by the network device.

8. The method of claim 1 , further comprising:
providing, to the client device, an address for a service node from which the service can be obtained.

9. The method of claim 1 , wherein the network device and the authorization service device are computing devices within different private domains.

10. One or more network devices in a distributed network, comprising:
one or more memory devices for storing instructions; and
one or more processors configured to execute the instructions to:
receive a first set of permissions with parameters to access a service, wherein the first set of permissions is in a first block of a shared ledger,
receive, from an authorization service device, an update to the shared ledger, wherein the update is in a second block of the shared ledger, the second block comprising a second set of permissions with conditions for the parameters,
store, in a local memory, the second block as part of an updated shared ledger, when the second block is validated by the distributed network,
receive, from a client device, a request to access the service, wherein the request includes client identification, and
provide, to the client device, access to the service when there is a match of the client identification and the service in the request with the parameters and conditions in the updated shared ledger.

11. The one or more network devices of claim 10 , wherein the shared ledger includes a read-only application binary interface (ABI) for use by the authorization service device to audit fields in the shared ledger.

12. The one or more network devices of claim 10 , wherein the authorization service device is within a different private domain than the one or more network devices.

13. The one or more network devices of claim 10 , wherein the one or more processors are further configured to execute the instructions to:
receive human-readable input to define the first set of permissions; and
convert the human-readable input to binary or hexadecimal code.

14. The one or more network devices of claim 10 , wherein the one or more processors are further configured to execute the instructions to:
convert the second set of permissions from human-readable input to compiled code.

15. The one or more network devices of claim 10 , wherein the update includes information specifying a new user for the service or a new permission parameter for an item.

16. The one or more network devices of claim 10 , wherein shared ledger identifies users that have permission to access the service.

17. The one or more network devices of claim 10 , wherein the one or more processors are further configured to execute the instructions to:
provide, to the client device, a content chunk for a requested content item.

18. A non-transitory computer-readable medium containing instructions executable by at least one processor, the computer-readable medium comprising one or more instructions to:
receive a first set of permissions with parameters to access a service, wherein the first set of permissions is in a first block of a shared ledger;
receive, from an authorization service device, an update to the shared ledger, wherein the update is in a second block of the shared ledger, the second block containing a second set of permissions with conditions for the parameters;
store, in a local memory, the second block as part of an updated shared ledger, when the second block is validated by a distributed network;
receive, from a client device, a request to access the service, wherein the request includes client identification; and
provide, to the client device, access to the service when there is a match of the client identification and the service in the request with the parameters and conditions in the updated shared ledger.

19. The non-transitory computer-readable medium of claim 18 , wherein the shared ledger includes a read-only application binary interface (ABI).

20. The non-transitory computer-readable medium of claim 18 , wherein the shared ledger includes a read-write application binary interface (ABI) for use by the authorization service device to update the shared ledger.

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Sardesai Ashish
• Pacella Dante J
• Mahey Sonit

Classifications

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• H04L9/3297

  involving time stamps, e.g. generation of time stamps · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L2209/38

  Electricity · mapped topic