File System Visibility Control via Community of Interest Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file system managers lack effective mechanisms to protect directories and files from unauthorized access, allowing users with access rights to visibility of all accessible directories and files, which can be detrimental to security as it reveals the presence or absence of sensitive files and directories.
Innovation Solution
Implementing a community of interest (COI) credential system where file system requests are processed by matching user COI credentials with directory or file COIs, making endpoints invisible to users without matching COIs, and only allowing authorized users to access and view specific endpoints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing file system access control mechanisms are used, then user access rights can be managed, but all users with access rights can see all directories and files in the file system
Solution Approach 1:
The patent segments the file system view by introducing COI-based virtual file systems. Each user receives a customized view of the file system containing only directories and files relevant to their COI, rather than showing all files. This is achieved by creating virtual file system structures that filter and present only authorized content to each user, thereby hiding the complete file system structure from unauthorized users while maintaining access control.
Solution Approach 2:
The patent introduces a COI credential verification mechanism as an intermediary between the user and the file system. This intermediary checks user credentials against COI associations for each directory and file, determining visibility and access rights. The intermediary layer filters the file system structure before presenting it to users, preventing direct exposure of the complete file system hierarchy while enabling controlled access to authorized resources.
2Ease of operation
If all accessible directories and files are visible to users with access rights, then complete access control is maintained, but security is compromised by revealing sensitive file information
Solution Approach 1:
The patent applies local quality by assigning different visibility properties to different directories and files based on their COI associations. Each file system object has customized visibility characteristics determined by its COI tags, allowing the system to present different views of the same file system structure to different users. This enables fine-grained control where each user sees only the portion of the file system relevant to their authorization level, reducing exposure to unauthorized access risks while maintaining operational ease for authorized users.
Data Source
AI summary
Systems and methods for establishing a secure file system are disclosed, in which system endpoints such as files and directories in a file system are protected using a security appliance. The security appliance protects each endpoint in the file system from unauthorized access by making those endpoints invisible to unauthorized users. The security appliance organizes users and endpoints into various communities of interest (COI). A user COI groups users such that all users associated with that particular COI have authorization to view the same one or more endpoints located in file storage.