File Access Policy Layer for Cross-Device Permission Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file access control systems struggle to provide consistent and granular access control across diverse devices and file systems, leading to unauthorized access and data security complications when files are copied or transferred.
Innovation Solution
A method and system that utilize a pool of access policies based on file metadata, user attributes, and device properties to determine and enforce access permissions, allowing for unified and granular control across different devices and file systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If access control lists (ACLs) are used to grant file access to specified users, then access control precision is improved, but device complexity and management difficulty increase as the number of files grows
Solution Approach 1:
The patent segments access control into two distinct layers: (1) file system-level ACLs that handle basic access permissions, and (2) organization-level policies that provide high-level access rules. This segmentation allows the system to maintain precise access control while reducing management complexity by separating detailed file-level permissions from broader organizational policies.
Solution Approach 2:
The patent creates a universal policy framework that can be applied across multiple file systems and organizations. The policy structure is designed to be multi-functional, serving both as a high-level access control mechanism and as a template that can be instantiated across numerous files and directories, thereby reducing repetitive management tasks.
2Measurement precision
If file access control is applied at the file system level, then access control precision is improved, but adaptability across different file systems deteriorates when files are copied to different devices
Solution Approach 1:
The patent implements a universal policy framework that transcends individual file systems. Policies are defined at the organization level and can be applied across multiple file systems and devices. When files are copied to different devices, the associated policies travel with them, ensuring consistent access control precision while maintaining adaptability across diverse file systems and devices.
Solution Approach 2:
The patent introduces policies as an intermediary layer between the file system and access control enforcement. This intermediary policy layer acts as a mediator that translates high-level organizational rules into file system-specific permissions, enabling precise access control that adapts across different file systems without requiring file system-level customization for each device.
3Measurement precision
If ACLs are linked to each individual file, then access control precision is improved, but ease of operation deteriorates as the number of files increases to millions
Solution Approach 1:
The patent segments access control management into hierarchical levels: organization-level policies that apply broadly across many files, and file system-level ACLs that handle specific file permissions. This segmentation allows administrators to manage access control for millions of files by defining high-level policies once, rather than individually configuring each file, thereby maintaining precision while dramatically improving ease of operation.
Solution Approach 2:
The patent applies partial action by implementing access control policies at the appropriate level of granularity. Instead of managing every single file permission individually (excessive action), the system applies organization-level policies that cover broad categories of files and users, achieving sufficient access control precision without the operational burden of managing every individual file permission.
Data Source
AI summary
Embodiments of this invention employ policies to determine permissions to be used to control users' access to files. The policies comprise conditions to match the metadata of files, conditions to match the properties of devices, conditions to match the attributes of users and a set of permissions. Upon receiving a request from a user to access a file on a device, the matching policies are selected by matching the file's metadata, the user's attribute and the properties of the device, and the final permissions are determined by merging the permissions from the matching policies. The final set of permissions can be used by applications to enforce the access of the file by the user on the device in the request.