Dynamic User Namespace for Secure Remote File Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed computing systems face challenges in accessing data assets stored in remote object storage services, as conventional techniques require all data portions to be stored together, leading to scalability issues and difficulties in accessing separate data and metadata portions, which restricts user operations and introduces security vulnerabilities.
Innovation Solution
A data access application that uses a manifest to dynamically manage access by identifying accessible assets and their locations, generating a user-specific namespace that only includes authorized data and metadata, allowing efficient and secure access to relevant assets without exposing unnecessary storage system portions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional storage techniques are used where all data portions must be stored together, then data integrity is maintained, but scalability deteriorates and access to separate data and metadata portions becomes difficult
Solution Approach 1:
The patent segments data assets into separate data portions and metadata portions stored in different locations within the distributed storage system. This allows independent access to data and metadata, improving scalability while maintaining data integrity through the manifest that tracks relationships between segments.
Solution Approach 2:
The patent introduces a manifest as an intermediary structure that maps data asset identifiers to their respective data and metadata portions stored in different endpoint stores. This mediator enables flexible access patterns without requiring co-location of all data portions, resolving the scalability-integrity contradiction.
2Ease of operation
If all data portions are stored together in conventional systems, then access simplicity is maintained, but resource waste increases when users need only specific portions
Solution Approach 1:
By segmenting data into separate portions with individual access paths through the manifest, the system enables users to retrieve only the specific portions they need rather than loading entire datasets, reducing resource consumption while maintaining simple access through the unified manifest interface.
Solution Approach 2:
The patent implements partial action by allowing users to access only the specific data and metadata portions required for their operations, rather than loading all available data. The manifest enables selective retrieval, reducing unnecessary resource consumption while maintaining operational simplicity.
3Ease of operation
If the entire storage system is exposed to users, then accessibility is maximized, but security vulnerabilities increase due to unauthorized access
Solution Approach 1:
The patent applies local quality by customizing the manifest content for each user based on their authorization levels. Each user receives a personalized manifest that includes only the data and metadata portions they are authorized to access, maintaining simple accessibility while preventing unauthorized access to other system portions.
Solution Approach 2:
The patent extracts and presents only the relevant authorized portions of the storage system to each user through their personalized manifest. This extraction approach maintains ease of operation for authorized users while inherently securing the system by excluding unauthorized portions from user view and access.
Data Source
AI summary
Various embodiments of the present application set forth a computer-implemented method for accessing data comprising determining a manifest associated with a given user of an application, where the manifest identifies one or more assets that are accessible by the given user, for each of the one or more assets, one of a plurality of endpoint stores that stores data associated with the asset, and for each of the one or more assets, one of the plurality of endpoint stores that stores metadata associated with the asset, generating, based on the manifest, a user namespace that includes a unique reference for each of the one or more assets, and presenting the user namespace to the user.