Permission Service for Dynamic OS-Agnostic Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software systems face complexity in managing permissions across multiple users and groups, especially when deployed on different hosts, and lack the ability for applications to dynamically control access to resources independently of the underlying operating system.
Innovation Solution
A Permission Service is introduced that manages permissions through a software-specific, OS-agnostic approach, allowing applications to declare custom permissions and grant access based on user IDs and group memberships, enabling dynamic control of resource access without creating new UIDs or GIDs, even on read-only file systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If UIDs and GIDs are tracked in operating system files on read-only filesystem to protect system integrity, then system reliability is improved, but dynamic creation of UIDs and GIDs is prevented
Solution Approach 1:
The patent segments the permission management system into two independent parts: the operating system's UID/GID management (stored in read-only filesystem for reliability) and the application-level permission management (stored in application-specific data structures for flexibility). This allows each part to function independently without compromising the other.
Solution Approach 2:
The patent introduces an intermediary permission management system that sits between the OS and applications. This intermediary layer handles dynamic permission requests by creating application-specific permission records without needing to modify OS-level UID/GID files, thus maintaining system integrity while enabling dynamic permission control.
2Manufacturing precision
If complex user group membership is used to manage access across multiple users and resources, then access control precision is improved, but system complexity increases
Solution Approach 1:
The patent extracts the complex user group membership management from the OS level and moves it to the application level. Applications maintain their own permission records that map users to required permissions directly, eliminating the need for complex OS-level group management while preserving precise access control.
Solution Approach 2:
Instead of managing permissions by organizing users into groups and assigning groups to resources (traditional OS approach), the patent inverts the model by having applications directly manage which users have which permissions through application-specific data structures. This simplifies the management model while maintaining precision.
3Reliability
If OS-level permission mechanisms are used for resource access control, then security is improved, but application-specific dynamic permission control is limited
Solution Approach 1:
The patent introduces dynamic permission records at the application level that can be created, modified, and removed without requiring OS-level changes. These dynamic records allow applications to adapt permission control to their specific needs while the underlying OS security mechanisms remain intact and unchanged.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method at a permission service on a computing device for managing permissions, the method including receiving a request at the permission service from a first application, the request comprising an identifier associated with an operating system for a second application and a permission for the second application to access resources; performing an action at the permission service based on the received request; and returning results of the action to the first application indicating whether the second application has the permission to access the resources.