Authentication-State Vault for Cloud Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges in securing sensitive information stored in cloud-based distributed storage systems, as existing security measures are cumbersome and inefficient, often requiring individual application to each file and lacking consistency across different applications.
Innovation Solution
A secure area, referred to as a 'vault', is introduced within the distributed storage system, which requires additional authorization measures like two-step verification to access, providing an extra layer of security. This vault can be accessed via various endpoints and integrates with existing file exploration interfaces, allowing for time-limited access and automatic locking to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures are applied to each individual file, then security coverage is improved, but user complexity and time consumption increase significantly
Solution Approach 1:
The patent merges security measures from individual file level to folder level by introducing authentication-state-based permissions. Instead of applying security to each file separately, the system combines security enforcement at the folder level, where a single authentication state (such as strong authentication) applies to all files within the folder, reducing user complexity while maintaining comprehensive security coverage.
Solution Approach 2:
The patent creates a universal permission system that works across multiple applications and file types. The authentication-state-based permission mechanism is designed to be application-agnostic, allowing the same permission rules to be enforced universally across different applications that access the folder, eliminating the need for application-specific security implementations.
2Reliability
If strong authentication is required for all data files, then security level is improved, but user convenience and processing efficiency deteriorate
Solution Approach 1:
The patent applies local quality by differentiating security requirements based on the sensitivity and location of data. Instead of uniformly applying strong authentication to all files, the system applies authentication-state-based permissions selectively to specific folders containing sensitive data. This allows strong authentication to be enforced only where needed (in protected folders) while leaving other folders accessible with standard authentication, thereby maintaining security for sensitive data without compromising overall processing efficiency.
3Adaptability or versatility
If each application implements its own security mechanism, then application-specific security needs are met, but consistency and system complexity increase
Solution Approach 1:
The patent introduces an intermediary permission system that sits between the user and the applications. The authentication-state-based permission mechanism acts as a mediator that translates user authentication states into enforced permissions, regardless of which application is accessing the data. This intermediary layer ensures consistent security enforcement across all applications without requiring each application to implement its own security mechanism, thereby maintaining security consistency while preserving application versatility.
Data Source
AI summary
A system is provided for facilitating access to data stored in a cloud-based storage service. Data associated with a user account is stored at the cloud-based storage service. A portion of the data is associated with a heightened authentication protocol. A request for an application to receive data that is associated with the heightened authentication protocol is received at the cloud-based storage service. In response to the request, the request is authenticated based on the heightened authentication protocol. In response to authenticating the request, permission is granted for the application to receive the data that is associated with the heightened authentication protocol. In response to a locking of the data that is associated with the heightened authentication protocol, an indication that the data is unavailable is sent to the application.