Secure Access Management (SAM)

The Access Layer is the core component of our protocol, governing who can access and decode user data. It provides a robust and flexible framework for managing permissions, ensuring that data is only accessible according to user-defined rules. This layer plays a critical role in maintaining privacy and enabling secure data computations.

Access Control Mechanisms

The Access Layer supports two primary forms of user-controlled permissions:

Initial Data Storage Permissions

• Description: When users add data to the system, they decide the privacy level of that data.

• Options:

  • Private: Data remains encrypted and only accessible by the user unless explicit permission is given.

  • Publicly Queryable: Data can be queried by certain trusted applications or services, while still maintaining a controlled access model.

Third-Party Compute Permissions

• Description: Users can grant third parties access to run computations on their data.

• Control Parameters:

  • Scope of Access: Users define which segments of data a third party can access.

  • Access Frequency: Users set limits on how often a third party may access or query the data.

  • Data Format: Permissions can specify whether a third party receives only the computed result or the raw data (if needed).

• Dynamic Controls: These permissions can be updated or revoked at any time to adapt to changing privacy or operational needs.

---

Distributed Ledger for OAuth Records

The technological backbone of the Access Layer is a distributed ledger that records every OAuth call and permission grant. This ledger ensures a tamper-proof, auditable record of access permissions.

• Unique OAuth ID: Each access grant is recorded with a unique identifier.

• Permission Set: Details about the specific permissions (scope, frequency, data format) are stored.

• Decryption Parameters: When access is granted, the relevant decryption parameters are encrypted using the compute’s public key.

• Validation Process: When a third party presents an OAuth token, the protocol verifies it against the distributed ledger. If valid, the corresponding compute job is scheduled, and the necessary decryption parameters are provided to the compute module.

---

Data Flow & OAuth Record Lifecycle

1. User Permission Setup:

   • The user specifies how data should be stored and who can access it.

   • A unique OAuth record is created and recorded on the distributed ledger.

2. Access Request:

   • When a third party or compute job requests access, it presents an OAuth token.

   • The protocol checks the distributed ledger for a matching record.

3. Validation & Scheduling:

   • If the OAuth token is valid, the compute job is scheduled.

   • The decryption parameters (encrypted with the compute's public key) are released to enable secure computation.

4. Post-Processing:

   • Once the computation is complete, the output is securely shared with the third party as defined by the user’s permissions.