Multi-User Device File System Container Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Standard sandboxing techniques are insufficient for multi-user devices to prevent data access between users sharing the same application, necessitating a method for flexible data segregation.
Innovation Solution
Assigning user-specific and system-wide containers with controlled access, using random character strings for container names and operating system processes to manage access, ensuring data is accessible only to the appropriate user or all users as needed, with encryption for authorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard sandboxing is used to isolate application data, then application-specific data security is improved, but multi-user data access control deteriorates (users sharing the same application cannot be prevented from accessing each other's data)
Solution Approach 1:
The patent segments the file system into multiple user-specific portions, each with isolated access controls. Each user's data is placed in a separate sandboxed portion, allowing standard sandboxing to secure application data while the multi-level segmentation enables distinct access controls for different users sharing the same application.
Solution Approach 2:
The patent implements local quality by applying different access control policies to different user portions of the file system. Each user has customized permissions and access rules specific to their data portion, allowing tailored security policies while maintaining overall system integrity through the sandboxed structure.
2Reliability
If user-specific data is stored separately for each user, then data privacy between users is improved, but resource efficiency deteriorates (large content assets are stored multiple times for each user)
Solution Approach 1:
The patent segments data into user-specific portions and shared portions within the sandboxed file system structure. Large content assets are stored once in the shared portion accessible by all users, while user-specific metadata and personalizations are stored in individual user portions, achieving both privacy and resource efficiency.
Solution Approach 2:
The patent merges shared content assets into a common storage portion that is accessible by multiple users within the sandboxed environment. This combining approach allows all users to access the same large files without duplicating storage, while the sandboxed structure maintains user isolation for private data.
3Reliability
If containers are assigned to processes for each user, then data segregation between users is improved, but system complexity increases (requiring container management processes and random character string assignments)
Solution Approach 1:
The patent implements self-service by having the container management processes automatically generate random character strings for container names and handle assignment without user intervention. The system autonomously manages container creation, naming, and allocation to user portions, reducing operational complexity while maintaining strong data segregation.
Solution Approach 2:
The patent introduces container management processes as intermediaries between users and the sandboxed file system. These intermediary processes handle the complexity of container creation, naming with random strings, and assignment to appropriate user portions, shielding users from the underlying system complexity while ensuring proper data segregation.
Data Source
AI summary
Some embodiments provide a method for a device having multiple users. The method identifies a process installed on the device that requires an isolated storage in a file system of the device. For each of a set of the users of the electronic device, the method assigns at least one container for use by the process within a user-specific section of the file system. The containers assigned to the process in a section of the file system specific to a particular user are only accessible by the process when the particular user is logged into the device. The method assigns at least one container for use by the process within a non-user-specific section of the file system. The containers assigned to the process within the non-user-specific section of the file system are accessible by the process irrespective of which user is logged into the device.