Distributed Filesystem Access Control via Client Trust Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed filesystems face security vulnerabilities due to non-unique user IDs across different computing devices, allowing unauthorized access and potential impersonation, and existing solutions either centralize IDs, leading to single points of failure or require complex encryption methods.
Innovation Solution
Implementing a system that uses user and client IDs to differentiate between trusted and non-trusted clients, with extended access permissions including a T bit indicating the client of origin and an L bit for access from non-trusted clients, ensuring unique user identification and secure access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional file access permissions are used in DFS, then users can access files based on user ID, but security vulnerabilities arise because user IDs are not unique across different computing devices
Solution Approach 1:
The patent introduces a new dimension to user identification by combining user ID with client ID. Instead of relying solely on user ID, the system now considers the client device as an additional identifying dimension. This allows the system to distinguish between the same user ID on different clients, resolving the security vulnerability while maintaining ease of access for authorized users.
Solution Approach 2:
The patent changes the parameters used for access control from just user ID to a combination of user ID and client ID. It also introduces extended access permissions with special bits (T bit and L bit) that modify the traditional permission model. This parameter change enables the system to enforce security policies based on both user identity and client trustworthiness.
2Reliability
If user IDs are centralized in a central repository, then unique user identification is ensured, but the system becomes vulnerable to single point of failure and can be bypassed
Solution Approach 1:
The patent extracts the client identification function from the centralized repository concept. Instead of storing all user IDs centrally and verifying against them, the system allows clients to generate their own unique client IDs locally. This eliminates the need for a centralized repository while ensuring uniqueness through the client-specific identifier.
Solution Approach 2:
The client ID serves multiple functions: it uniquely identifies the client device, establishes trust relationships, and enables security policies. This multi-functional approach replaces the need for a centralized repository that would otherwise need to manage user ID uniqueness, authentication, and policy enforcement.
3Reliability
If encryption keys are used for additional security, then access control is enhanced, but system complexity and administrator training requirements increase significantly
Solution Approach 1:
The patent uses client IDs that are generated locally and do not require complex encryption key management. These client IDs act as simple, disposable identifiers that provide security without the overhead of cryptographic key pairs. The system achieves security through the combination of user ID and client ID rather than through encryption.
4Ease of operation
If all users with the same user ID are treated as owners, then access is simplified, but unauthorized access and impersonation become possible
Solution Approach 1:
The patent segments the user identification into two distinct parts: user ID and client ID. This segmentation allows the system to treat the same user ID differently depending on which client it is accessing from. The T bit and L bit in extended permissions further segment access control based on client trust status, preventing unauthorized access while maintaining simplicity for authorized scenarios.
Data Source
AI summary
A system and method for providing access in a distributed filesystem. The disclosure describes systems and methods for providing access to filesystem objects in a distributed filesystem (DFS). In one implementation, access to filesystem objects in the DFS can be restricted to only authenticated users and client devices. To this end, the client devices of the DFS can be divided into trusted and non-trusted clients, and further access can be denied to non-trusted clients. Concepts of trusted computing can be utilized to obtain trusted clients. New clients added to the system can be added as non-trusted clients. Further, access can be restricted by extending the file access permissions to include additional bits that can control access to non-trusted clients. In certain situations, the owner of the object can be allowed access to the object from a non-trusted client.