Content-Based File System Security via Virtual Directory Caching

Solution Overview

Problem

Content-based file systems pose security challenges as users can deduce file content information by knowing the existence of virtual directories or files, and conventional directory-level access security is not applicable since directories are generated dynamically in response to user requests, lacking advance knowledge of possible virtual directories.

Innovation Solution

Enforce physical file system security rights by allowing access to virtual directories and files only if the user has permission to read the associated files, creating a separate content-based directory tree for each user with a unique virtual root access directory, and deriving virtual directories from files the user has permission to read.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If conventional directory-level access security is used in physical file systems, then access control is straightforward, but it cannot be applied to content-based file systems where directories are dynamically generated

Engineering Contradiction:

Improveadaptability to content-based file systemsVSAvoidcomplexity of access security enforcement

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system performs preliminary action by pre-computing and caching virtual directory structures based on file metadata before user access requests. This allows the dynamically generated virtual directories to be prepared in advance with security information, enabling conventional access control mechanisms to function effectively in content-based file systems without requiring complex real-time security decisions.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention creates a virtual copy of the physical file system structure that mirrors the actual files and directories. This virtual copy includes replicated directory entries and file references that can be independently managed and secured. By working with this copy rather than the physical structure directly, the system can apply conventional access control algorithms to a simplified representation, reducing the complexity of enforcing security in the dynamic content-based environment.

Inventive Principle:

Principle #26Copying

2Adaptability or versatility

If virtual directories are generated dynamically in response to user requests, then the file system is flexible and adapts to user needs, but access security cannot be enforced in advance

Engineering Contradiction:

Improveflexibility of directory generationVSAvoidreliability of access security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary action by pre-computing and caching virtual directory structures based on file metadata before user access requests. This allows the dynamically generated virtual directories to be prepared in advance with security information, enabling conventional access control mechanisms to function effectively in content-based file systems without requiring complex real-time security decisions.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention introduces a virtual directory structure as an intermediary layer between the physical file system and the user interface. This virtual layer acts as a mediator that translates user access requests into secure queries against pre-computed virtual directory structures. The intermediary contains security enforcement logic that filters and controls access before reaching the physical files, ensuring reliable security while maintaining the flexibility of dynamic directory generation.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Ease of operation

If knowledge of virtual directory existence is made available to users, then navigation and access are simplified, but users can deduce information about file content without reading

Engineering Contradiction:

Improveease of file system navigationVSAvoidinformation leakage through directory existence

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system applies local quality by providing different visibility characteristics to different virtual directory entries based on user permissions. Authorized users see complete directory structures with all files and subdirectories, while unauthorized users see truncated or modified views where sensitive directories are hidden or renamed. This selective disclosure maintains ease of navigation for authorized users while preventing information leakage to unauthorized users through the virtual directory structure itself.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The invention introduces a virtual directory structure as an intermediary layer between the physical file system and the user interface. This virtual layer acts as a mediator that translates user access requests into secure queries against pre-computed virtual directory structures. The intermediary contains security enforcement logic that filters and controls access before reaching the physical files, ensuring reliable security while maintaining the flexibility of dynamic directory generation.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS8447781B2Content-based file system security

Publication Date: 2013.05.21 AIRBNB INC

AI summary

A method for enforcing computer-based file system security, the method comprising generating a content-based file system from files in a physical file system, and enforcing a user access right to any aspect of the content-based file system, where the user access right derives from a user access right to a file in the physical file system.