Custom Pre-Signed URLs for Granular Access Control in Object Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer networks face challenges in ensuring data integrity and security during cloud storage and processing, particularly in dispersed storage networks where data is distributed across multiple sites, making it difficult to maintain data availability and security in the face of storage unit failures or unauthorized access.
Innovation Solution
A dispersed storage network (DSN) architecture that utilizes error encoding and decoding techniques, such as Cauchy Reed-Solomon encoding, to distribute data across multiple storage units, allowing for data recovery even with failures and ensuring secure storage and retrieval, along with customized pre-signed URLs for enhanced access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is distributed across multiple storage units in a dispersed storage network, then data availability and fault tolerance are improved, but system complexity and difficulty of managing access control increase
Solution Approach 1:
The patent segments data into multiple data slices that are distributed across different storage units. Each slice is independently stored, allowing the system to maintain data availability even when individual storage units fail. This segmentation approach directly improves reliability while the automated slicing management helps control system complexity.
Solution Approach 2:
The patent introduces pre-signed URLs as an intermediary mechanism for access control. These URLs encode authentication credentials and policy information, acting as a mediator between the requesting entity and the distributed data slices. This intermediary approach simplifies access management compared to direct authentication with each storage unit, thereby addressing the complexity issue while maintaining the distributed architecture's reliability benefits.
2Adaptability or versatility
If traditional pre-signed URLs are used for access control, then implementation simplicity is maintained, but security and access control granularity are insufficient
Solution Approach 1:
The patent enhances traditional pre-signed URLs by incorporating additional parameters that encode fine-grained access control policies. These parameters specify conditions such as time windows, IP address ranges, and permitted operations. By changing the URL structure to include these parameters, the system achieves greater adaptability and access control granularity without requiring a completely new authentication system, thus managing complexity effectively.
3Adaptability or versatility
If custom policy parameters are added to pre-signed URLs, then access control precision is improved, but URL processing complexity increases
Solution Approach 1:
The patent implements preliminary validation of custom policy parameters when the pre-signed URL is generated. The access control logic is embedded and pre-configured in the URL structure itself, including time windows, IP restrictions, and operation permissions. This preliminary action approach allows the storage system to automatically evaluate these pre-set conditions during URL processing without requiring complex real-time policy interpretation, thereby improving access control precision while managing processing complexity through advance preparation.
Data Source
AI summary
A method for execution by an access layer of an object storage system includes In various embodiments, a processing system of an access layer of an object storage system includes at least one processor and a memory that stores operational instructions, that when executed by the at least one processor cause the processing system to receive a request message from a requesting entity via a network, where the request message includes a pre-signed URL. A set of custom policy parameters are extracted from the pre-signed URL. Policy verification data is generated by comparing each attribute of a determined set of attributes of the access request to a corresponding custom policy parameter of the set of custom policy parameters. An access indicated in the request message is executed in response to the policy verification data indicating that each attribute compares favorably to the corresponding custom policy parameter.