Granted Patent B1

US 12,278,816 · App. 18/975,491 · Granted Apr 15, 2025

Inventors: Jesús Alejandro Cárdenes Cabré (Montreal, CA); Jeremy Taylor (Montreal, CA); Madjid Aoudia (Rennes, FR); John Christopher Muddle (St. Albans, GB); Colin Gounden (Cambridge, MA)

Assignee: Via Science, Inc.

H04L63/10H04L9/3218

Abstract

Claims (74)

1. A computer-implemented method comprising:

sending, to a distributed ledger system, policy data indicating an association between a first credential and a first permission for accessing a computer resource, wherein a first client device receives first credential data representing the first credential;

receiving, by an access gateway system from the first client device, a first request for access to the computer resource;

receiving, from the first client device, first data representing a zero-knowledge proof of possession of the first credential;

verifying, using the first data, that the first client device corresponds to the first credential;

in response to verifying that the first client device possesses the first credential, retrieving, from the distributed ledger system, the policy data corresponding to the first credential;

determining that the policy data grants a possessor of the first credential access to the computer resource; and

in response to determining that the policy data grants the possessor of the first credential access to the computer resource, allowing the first client device access to the computer resource.

2. The computer-implemented method of claim 1 , wherein the first credential data is sent to the first client device by an identity provider system separate from the access gateway system and the computer resource.

3. The computer-implemented method of claim 1 , further comprising:

receiving, from the first client device, a second request to upload second data for hosting by the computer resource, the second data representing digitally signed content;

determining that the policy data authorizes the possessor of the first credential to upload the second data to the computer resource; and

in response determining that the policy data authorizes the possessor of the first credential to upload the second data to the computer resource, causing the computer resource to receive the second data.

4. The computer-implemented method of claim 3 , further comprising:

determining that the second request corresponds to an account identifier;

retrieving, from the distributed ledger system, third data representing a public cryptographic key corresponding to the account identifier; and

authenticating the second data using the third data, wherein causing the computer resource to receive the second data is additionally based on authenticating the second data.

5. The computer-implemented method of claim 1 , further comprising:

receiving, from the first client device, a second request to declassify a secured data item;

determining that the policy data authorizes the possessor of the first credential to declassify the secured data item; and

in response determining that the policy data authorizes the possessor of the first credential to declassify the secured data item, causing the computer resource to move the secured data item from a first data storage component to a second data storage component, the first data storage component representing a secure data store.

6. The computer-implemented method of claim 1 , further comprising:

receiving, from the first client device, a second request for the computer resource to execute a computer program using second data stored by the computer resource;

determining that the policy data authorizes the possessor of the first credential to access the second data; and

in response determining that the policy data authorizes the possessor of the first credential to access the second data, causing the computer resource to execute the computer program using the second data to generate results data and send the results data to the first client device.

7. The computer-implemented method of claim 6 , further comprising:

analyzing the computer program to determine a first function to be performed using the second data; and

determining that the policy data authorizes the possessor of the first credential to perform the first function, wherein causing the computer resource to execute the computer program is additionally based on determining that the policy data authorizes the first function.

8. The computer-implemented method of claim 1 , further comprising:

receiving, from an identity provider system, second data representing a verifier key, the identity provider system sending, to the first client device, third data representing a prover key corresponding to the verifier key;

causing the first client device to generate the first data using the third data;

and processing the first data and the second data to determine that the first data represents a true claim.

9. The computer-implemented method of claim 1 , further comprising:

sending, to a second client device, second credential data representing the first credential.

10. The computer-implemented method of claim 1 , further comprising:

receiving, from the first client device, a second request for access to the computer resource, the first request corresponding to a first operation and the second request corresponding to a second operation different from the first operation;

determining that the policy data authorizes the first operation but not the second operation; and

in response to determining that the policy data does not authorize the second operation, denying, by the access gateway system, the second request.

11. A system, comprising: at least one processor; and at least one memory comprising instructions that, when executed by the at least one processor, cause the system to:

send, to a distributed ledger system, policy data indicating an association between a first credential and a first permission for accessing a computer resource, wherein a first client device receives first credential data representing the first credential;

receive, by an access gateway system from the first client device, a first request for access to the computer resource; receive, from the first client device, first data representing a zero-knowledge proof of possession of the first credential;

verify, using the first data, that the first client device corresponds to the first credential; in response to verifying that the first client device possesses the first credential, retrieve, from the distributed ledger system, the policy data corresponding to the first credential;

determining that the policy data grants a possessor of the first credential access to the computer resource;

and in response to determining that the policy data grants the possessor of the first credential access to the computer resource, allowing the first client device access to the computer resource.

12. The system of claim 11 , wherein the first credential data is sent to the first client device by an identity provider system separate from the access gateway system and the computer resource.

13. The system of claim 11 , wherein the instructions further cause the system to:

receive, from the first client device, a second request to upload second data for hosting by the computer resource, the second data representing digitally signed content;

determine that the policy data authorizes the possessor of the first credential to upload the second data to the computer resource; and

in response determining that the policy data authorizes the possessor of the first credential to upload the second data to the computer resource, cause the computer resource to receive the second data.

14. The system of claim 13 , wherein the instructions further cause the system to:

determine that the second request corresponds to an account identifier;

receive, from the distributed ledger system, third data representing a public cryptographic key corresponding to the account identifier; and

authenticate the second data using the third data, wherein causing the computer resource to receive the second data is additionally based on authenticating the second data.

15. The system of claim 11 , wherein the instructions further cause the system to:

receive, from the first client device, a second request to declassify a secured data item;

determine that the policy data authorizes the possessor of the first credential to declassify the secured data item; and

in response determining that the policy data authorizes the possessor of the first credential to declassify the secured data item, cause the computer resource to move the secured data item from a first data storage component to a second data storage component, the first data storage component representing a secure data store.

16. The system of claim 11 , wherein the instructions further cause the system to:

receive, from the first client device, a second request for the computer resource to execute a computer program using second data stored by the computer resource;

determine that the policy data authorizes the possessor of the first credential to access the second data; and

in response determining that the policy data authorizes the possessor of the first credential to access the second data, cause the computer resource to execute the computer program using the second data to generate results data and send the results data to the first client device.

17. The system of claim 16 , wherein the instructions further cause the system to:

analyzing the computer program to determine a first function to be performed using the second data; and

determine that the policy data authorizes the possessor of the first credential to perform the first function, wherein causing the computer resource to execute the computer program is additionally based on determining that the policy data authorizes the first function.

18. The system of claim 11 , wherein the instructions further cause the system to:

receive, from an identity provider system, second data representing a verifier key, the identity provider system sending, to the first client device, third data representing a prover key corresponding to the verifier key;

causing the first client device to generate the first data using the third data; and

process the first data and the second data to determine that the first data represents a true claim.

19. The system of claim 11 , wherein the instructions further cause the system to:

send, to a second client device, second credential data representing the first credential.

20. The system of claim 11 , wherein the instructions further cause the system to:

receive, from the first client device, a second request for access to the computer resource, the first request corresponding to a first operation and the second request corresponding to a second operation different from the first operation;

determine that the policy data authorizes the first operation but not the second operation; and

in response to determining that the policy data does not authorize the second operation, deny, by the access gateway system, the second request.

Assignments (2)

Continuity (2)

References Cited (12)