Cross-Node Identifier Mapping for Consistent File Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data management systems, inconsistencies in Windows security identifier (SID) to Unix user identifier (UID) or group identifier (GID) mappings across nodes in a cluster lead to access control issues, where unauthorized users may gain access or authorized users may be denied access due to differing mappings.
Innovation Solution
Implement a shared repository for global SID/UID/GID mapping accessible to all nodes, using a central database to ensure consistent mappings by retrieving or assigning UIDs/GIDs based on SIDs, eliminating the need for local mappings on each node.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If each node maintains local SID/UID/GID mappings, then mapping flexibility is improved, but access control consistency deteriorates
Solution Approach 1:
The patent merges the SID/UID/GID mapping functionality from individual node-level databases into a single centralized mapping database that is accessible by all nodes in the cluster. This eliminates the distributed mapping approach and ensures that all nodes use the same mapping rules, thereby resolving the contradiction between mapping flexibility and access control consistency.
Solution Approach 2:
The patent introduces a centralized mapping database as an intermediary component between the nodes and the identifier mapping process. This intermediary stores and provides consistent SID/UID/GID mappings to all nodes, ensuring that access control decisions are made based on uniform mapping rules across the entire cluster.
2Adaptability or versatility
If local mappings are used on each node, then node independence is improved, but storage overhead increases
Solution Approach 1:
The patent combines multiple local mapping databases into a single centralized mapping database. Instead of each node storing its own copy of the mapping data, all nodes access a shared mapping database, thereby reducing redundant storage while maintaining node independence through network access.
3Reliability
If centralized mapping is implemented, then access control consistency is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal mapping database that serves multiple functions: storing SID/UID/GID mappings, providing consistent access control rules across all nodes, and serving as a single source of truth for identifier translation. This multi-functionality justifies the added system complexity by consolidating multiple roles into one component.
Data Source
AI summary
Methods, systems, and devices for data management are described. A server hosted by a storage node within a cluster of a data management system (DMS) may receive a request to access a file stored in a distributed file system. The request may be associated with a security identifier (SID). The server may transmit an indication of the SID to a shared repository accessible to the cluster. Accordingly, the server may receive an indication of a mapping between the SID and one or both of a user identifier (UID) or a group identifier (GID) associated with the SID. The server may transmit an indication of the file and the UID/GID to the distributed file system, which may compare the UID/GID to a list of authorized identifiers for the file. If the UID/GID is on the list of authorized identifiers, the distributed file system may execute the request accordingly.