Network File System Operation Restriction Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack effective mechanisms to enforce operation restrictions on file system entities over networks based on client location and operation expiry, leading to potential unauthorized access and data misuse.
Innovation Solution
A method where a server receives a client's locale and uses supplemental data, including locality and operation expiry information, to determine whether requested operations on a file system entity are permitted, ensuring that operations are restricted according to defined territories and time limits, and transcoding the file system entity for compatibility if necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If operation restrictions are enforced based on client locale and supplemental data, then data sovereignty and security are improved, but system complexity increases
Solution Approach 1:
The system performs preliminary actions by receiving and storing the client's locale information during session setup, and by pre-associating supplemental data (locality data and operation expiry data) with file system entities before operations are requested. This preparation enables efficient enforcement of operation restrictions without adding complexity to the actual operation execution path.
Solution Approach 2:
The patent introduces supplemental data as an intermediary layer between the client request and the file system entity. This supplemental data (containing locality data and operation expiry data) acts as a mediator that the server consults to determine whether to permit operations, thereby enforcing data sovereignty without requiring complex embedded logic within the file system itself.
2Measurement precision
If locale verification and supplemental data checking are performed for each operation, then access control accuracy is improved, but operation speed decreases
Solution Approach 1:
The server receives and stores the client's locale information during session setup as a preliminary action, making it readily available for subsequent operation checks without requiring repeated retrieval. This pre-positioning of locale data reduces the overhead for each individual operation verification.
Solution Approach 2:
The client is responsible for providing its own locale information during session setup, and the server uses this self-provided information along with pre-associated supplemental data to make access decisions. This self-service approach reduces the burden on the server to actively verify client location for each operation.
3Duration of action of moving object
If operation expiry data is enforced, then data lifecycle control is improved, but additional validation overhead is introduced
Solution Approach 1:
The patent merges locality data and operation expiry data into a unified supplemental data structure that is associated with file system entities. By combining these two types of control information into a single consultable resource, the system enforces both location-based and time-based restrictions without requiring separate validation mechanisms, thereby reducing overall validation overhead.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
The enforcement of operation restriction on a file system entity over a network. The file system entity exists on a server (which could be a single machine, a cluster of servers, or a cloud computing environment). The server facilitates setting up of a session over a network with a client. As part of this facilitation, the server receives from the client a locale of the client. Upon subsequent receipt from the client of a request to perform an operation on the file system entity, the client consults supplemental data to determine whether the requested operation is permitted on the file system entity. The supplemental data may comprise at least one of the locality information or operation expiry data.