Document Revision Access Control via Permission Snapshots
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file systems struggle to control access to cached revisions of documents without violating permissions, especially when advanced operating systems use dynamic mechanisms like Access Control Lists (ACLs) and kernel plugins, which cannot be cached.
Innovation Solution
A system that uses a multi-user permissions and ownership model to control access to document revisions, where only the owner of a document at the time of the revision can access past revisions, and for the most-recent revision, it defers to existing file system permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If previous revisions of files are cached to enable access to historical data, then access to document revisions is improved, but permission control integrity deteriorates because dynamic permission mechanisms cannot be cached
Solution Approach 1:
The system segments permission control into two distinct parts: (1) cached permission snapshots associated with each document revision that can be stored and retrieved efficiently, and (2) dynamic permission mechanisms (ACLs, kernel plugins) that remain uncached and operate in real-time. This segmentation allows revision access to be fast while maintaining permission integrity through the uncached dynamic checks.
Solution Approach 2:
The system performs preliminary permission evaluation by capturing permission states at the time of each revision creation and storing them as snapshots. This preliminary action creates a frozen record of who had access when, which can then be efficiently queried without requiring real-time permission system access, thus improving access speed while maintaining integrity.
2Reliability
If dynamic permission mechanisms like ACLs and kernel plugins are used to control access, then permission control accuracy is improved, but access speed deteriorates because these mechanisms cannot be cached and must be evaluated in real-time
Solution Approach 1:
The system extracts the permission evaluation function from the dynamic permission mechanisms and implements it separately as cacheable permission snapshots. By taking out this function, the system can cache the results for fast retrieval while the original dynamic permission mechanisms (ACLs, kernel plugins) continue to operate independently to maintain accuracy when needed.
3Productivity
If permission snapshots are cached for previous revisions, then access speed to revisions is improved, but permission control flexibility deteriorates because cached permissions cannot adapt to real-time permission changes
Solution Approach 1:
The system implements dynamics by maintaining both static cached permission snapshots for fast access and dynamic real-time permission mechanisms that can adapt to changing conditions. The cached snapshots provide stable, fast access for historical revisions, while the dynamic mechanisms continue to adapt to real-time permission changes, ensuring both speed and flexibility coexist.
Data Source
AI summary
One embodiment of the present invention provides a system that controls accesses to revisions of documents in the presence of a multi-user permissions and ownership model. During operation, the system receives a request to on behalf of a user to access a revision of a document. If the request is directed to a most-recent revision of an existing document, the system uses the multi-user permissions and ownership model to control access to the revision. Otherwise, if the request is directed to a previous revision of the document, the system grants access to the revision only if the user was the owner of the document at the time of the revision.