Directory Access Control via Segmented Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Secure operating systems that implement mandatory access control using traditional UNIX permissions face issues with permission inheritance, where granting search access to a directory inadvertently grants list access to parent directories, restricting content storage and increasing administrative overheads.
Innovation Solution
Introducing a new directory access permission called 'nsearch' that allows entities to search and change directories without listing their contents, breaking the inheritance chain and requiring explicit permissions for each directory, thereby isolating access rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If traditional UNIX permissions are used to implement mandatory access control, then simplicity is improved, but security control precision deteriorates
Solution Approach 1:
The patent segments the traditional unified read permission into two distinct permission types: search permission (for directory lookup) and list permission (for directory contents access). This segmentation allows independent control of these operations, enabling precise security policies where entities can search directories without automatically gaining list access, thereby resolving the contradiction between simplicity and security control precision.
2Ease of operation
If search access to a directory is granted using traditional permissions, then ease of operation is improved, but security control deteriorates due to inadvertent list access
Solution Approach 1:
By dividing the read permission into separate search and list permissions, the system maintains ease of operation (entities can still search directories) while improving security control (list access is no longer automatic). The segmentation ensures that search permission alone does not imply list permission, preventing the security vulnerability described in the contradiction.
3Productivity
If permission inheritance is applied to directories, then productivity is improved, but administrative overhead increases
Solution Approach 1:
The patent applies local quality by allowing different permission settings (search vs. list) at each directory level independently. Rather than forcing uniform inheritance of all permissions, administrators can selectively apply search permission without list permission at specific directories, reducing unnecessary administrative overhead while maintaining productivity through localized permission management.
Data Source
AI summary
Certain embodiments of the invention relate to an access control system for controlling access to file system objects stored in a digital file system store. The system provides a first compartment rule type for granting a first permission to an entity, associated with a respective compartment to which the rule is applied, to lookup a directory object in a directory path and list the contents of the said directory object, and a second compartment rule type for granting a second permission to an entity, associated with a respective compartment to which the rule is applied, to lookup a directory object in a directory path and not to list the contents of the said directory object.