Dynamic Permission Modes for Distributed File Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed file systems, mismatches in permission and access control semantics across different client systems lead to inconsistent and arbitrary standards, causing confusion and inefficiencies, as different systems have different native permission schemes that are not compatible with each other.
Innovation Solution
A file system engine and permissions engine are implemented to map native permission values from client systems to platform permission values, using dynamic permission modes and map rules that convert between different permission schemes, ensuring consistent access rights and reducing latency by providing joint or disjoint platform permission values supported by all clients.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If different client systems use their native permission schemes in a distributed file system, then each client system operates with its own familiar access control semantics, but permission mismatches and inconsistencies arise across the distributed system
Solution Approach 1:
The patent introduces a permissions engine as an intermediary component that sits between the file system engine and client systems. This permissions engine receives access requests from clients using their native permission schemes, translates them into a universal permission model, and enforces access control. The permissions engine acts as a mediator that enables multiple client systems with different permission semantics to access the distributed file system consistently without requiring changes to the clients themselves.
Solution Approach 2:
The patent implements dynamic permission modes that can change the permission model based on the client system's native scheme. The system supports multiple permission modes (e.g., POSIX mode, Windows mode, Unix mode) and can dynamically switch between them or translate between them. This parameter change approach allows the file system to adapt its permission handling to match the client's expectations while maintaining internal consistency through a universal underlying model.
2Adaptability or versatility
If arbitrary mapping standards are used to translate between different permission systems, then compatibility between client systems is achieved, but the mapping becomes inconsistent and confusing
Solution Approach 1:
The patent implements a universal permission model that serves as a common denominator for all client permission schemes. The permissions engine provides multi-functional capability to handle POSIX permissions, Windows ACLs, Unix permissions, and other schemes through a single unified interface. This universal model defines a set of core permission operations (read, write, execute, delete, etc.) that can be consistently mapped from various client permission systems, providing clarity and consistency in the mapping process.
Solution Approach 2:
The system provides configurable permission mode parameters that can be set based on the client system type. These parameters control how translations are performed and can be adjusted to prioritize certain permission aspects over others. The dynamic permission modes allow the mapping behavior to be changed based on the operational context, providing both consistency and adaptability in permission translation.
3Reliability
If permission translation and mapping operations are performed for every access request, then consistent access rights are maintained across different clients, but computational overhead and latency increase
Solution Approach 1:
The patent implements permission caching mechanisms that perform permission translation in advance. When a file is accessed for the first time, the permissions engine translates the client's native permission scheme to the universal model and caches the result. Subsequent access requests for the same file by the same client can use the cached permission information, avoiding repeated translation operations. This preliminary action approach maintains consistency while reducing the computational overhead for repeated accesses.
Solution Approach 2:
The system applies different permission translation strategies based on the local context of each access request. The permissions engine analyzes the specific client type, file type, and access pattern to determine the most efficient translation approach. For example, it may use simplified mapping for common operations or more detailed mapping for sensitive operations. This local quality approach optimizes the balance between consistency and performance based on the specific operational context.
Data Source
AI summary
Embodiments are directed to managing data in a file system. A file system engine provides a file system that includes file system objects that may be accessible by two or more clients that use different native permission schemes. And, a permissions engine may determine map rules based on characteristics of a request to access request a file. The permission engine may execute the one or more map rules to provide platform permission values based on the native permission values. The permission engine may compare requested platform permission values to the platform permission values associated with the file. The permission engine may provide the access rights to the file based on an affirmative result of the comparison.