Managing blockchain access
View Patent ↗Techniques are described for managing access to data stored in a blockchain, and for managing the communication of blockchain data to other entities. A private key may be generated and issued to an external entity to enable the external entity to access an internal (e.g., private blockchain). The external entity may be an external (e.g., public) blockchain, device, process, or user that is outside an internal network. The key may be associated with metadata that includes constraints, conditions, or rules governing access to the blockchain. An authorized entity may employ the key to request access to the blockchain via access management module(s), and the access management module(s) may employ the metadata to determine whether to approve the request. The access management module(s) may also employ rules governing outbound communication of data from internal blockchain(s) to external entities.
1. A computer-implemented method using an access management device, wherein the method is performed by at least one processor of the access management device and the method comprises:
receiving, by the at least one processor, a request from a first blockchain to access a portion of data stored in a second blockchain, wherein the request comprises a key and the access management device is configured to manage access from the first blockchain to the second blockchain, wherein the second blockchain is only accessible via an internal network, and the first blockchain is external to the internal network;
accessing, by the at least one processor, metadata associated with the key, wherein the metadata comprises;
one or more time restrictions, wherein the one or more time restrictions correspond to one or more time periods during which the key is usable for accessing the portion of data stored in the second blockchain;
a number of instances that the key can be used for accessing the portion of data in the second blockchain or identification of a computing system that is authorized to access the second blockchain using the key; and
at least one indication of at least one third party associated with the second blockchain, and wherein the key comprises a unique identifier that corresponds to the portion of the data stored in the second blockchain, and wherein the metadata is stored in a memory of the access management device;
determining, using the at least one processor, compliance of the request with the one or more time restrictions of the metadata associated with the key to create an access response, comprising:
determining that the request is received within the one or more time periods during which the key is usable for accessing the portion of data stored in the second blockchain;
transmitting the request to the at least one third party in response to the request being received within the one or more time periods; and
receiving a consent from the at least one third party for the first blockchain to access the second blockchain;
wherein the access response comprises an approval response in response to receiving the consent; and
providing, by the at least one processor, access to the portion of data stored in the second blockchain by the first blockchain based on the access response.
2. The method of claim 1 , wherein:
determining the compliance with the one or more time restrictions comprises determining that the request is received prior to a threshold amount of requests is received, wherein the threshold amount of requests corresponds to a threshold number of instances.
3. The method of claim 1 , wherein:
determining the compliance of the request with one or more restrictions of the metadata associated with the key to create an additional access response, wherein the compliance of the request comprises determining that the request is received from the computing system identified in the metadata.
4. The method of claim 3 , wherein the identification of the computing system comprises:
an internet protocol (IP) address of the computing system;
a media access control (MAC) address of the computing system; or
an identifier associated with an operator of the computing system.
5. The method of claim 1 , further comprising:
detecting, by the at least one processor, an attempt to provide access to a second portion of data stored in the second blockchain to the first blockchain;
accessing, by the at least one processor, one or more rules associated with the second blockchain, wherein the one or more rules comprise a second set of restrictions to access the second portion of data; and
determining that the attempt complies with the second set of restrictions to access the second portion of data; and
allowing, by the at least one processor, access of data in the second blockchain to the first blockchain.
6. The method of claim 5 , wherein:
the second set of restrictions comprise internal users authorized to provide access to data stored in the second blockchain; and
determining that the attempt complies with the second set of restrictions comprises determining that the attempt is associated with one of the internal users of the second set of restrictions.
7. The method of claim 5 , wherein:
the second set of restrictions comprise one or more external entities authorized to receive data stored in the second blockchain; and
determining that the attempt complies with the second set of restrictions comprises determining that the one or more external entities of the second set of restrictions comprise the first blockchain.
8. The method of claim 1 , comprising:
receiving, by the at least one processor, an additional request to enable access to the portion of data in second blockchain, wherein the additional request comprises the portion of data and one or more restrictions for accessing the portion of data;
generating the key and the metadata associated with the key based on the additional request to enable access, wherein the metadata comprises the one or more restrictions for accessing the portion of data; and
storing the metadata in the memory of the access management device.
9. The method of claim 1 , comprising determining, using the at least one processor, non-compliance of a subsequent request and wherein the access response comprises a denial response.
10. A system, comprising:
at least one processor of an access management device; and
a memory of the access management device communicatively coupled to the at least one processor, the memory storing instructions which, when executed, cause the at least one processor to perform operations comprising:
receiving a request for a first blockchain to access a portion of data stored in a second blockchain, wherein the request comprises a key and the access management device is configured to manage access from the first blockchain to the second blockchain, wherein the second blockchain is only accessible via an internal network, and the first blockchain is external to the internal network;
accessing metadata associated with the key from the memory, wherein the metadata comprises:
one or more time restrictions, wherein the one or more time restrictions correspond to one or more time periods during which the key is usable for accessing the portion of data stored in the second blockchain;
the metadata comprises a number of instances that the key can be used for accessing the portion of data in the second blockchain or identification of a computing system that is authorized to access the second blockchain using the key; and
at least one indication of at least one third party associated with the second blockchain, and wherein the key comprises a unique identifier that corresponds to the portion of the data stored in the second blockchain, and the metadata was generated by the access management device in conjunction with the key;
determining compliance of the request with the one or more time restrictions of the metadata associated with the key to create an access response, comprising:
determining that the request is received during the one or more time periods during which the key is usable for accessing the portion of data stored in the second blockchain;
transmitting the request to the at least one third party in response to the request being received within the one or more time periods; and
receiving a consent from the at least one third party for the first blockchain to access the second blockchain;
wherein the access response comprises an approval response in response to receiving the consent; and
providing the first blockchain with access to the portion of data stored in the second blockchain based on the access response.
11. The system of claim 10 , wherein:
the metadata describes a number of instances that the key can be used for accessing the portion of data in the second blockchain using the key; and
determining that the request complies with the one or more time restrictions comprises determining that the request is received prior to a threshold amount of requests is received, wherein the threshold amount of requests corresponds to a threshold number of instances.