Flexible Access Control List Evaluation for Cloud Content Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Most content management systems are optimized for specific usage models and are not flexible enough to accommodate modern cloud-based systems, lacking a robust and flexible access control mechanism that can efficiently manage access changes and provide customized access policies.
Innovation Solution
A content management system with a flexible access permission model that allows access permissions to apply to directories or specific objects, inherit from global policies, and suppress inherited permissions, using unique indexes for efficient data retrieval and storage, and a hybrid logical clock for system-wide event ordering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a content management system is optimized for a particular usage model, then it can achieve high performance for that specific model, but it becomes poorly suited for other usage mechanisms and lacks flexibility
Solution Approach 1:
The patent implements a universal access control mechanism that can handle multiple usage models through a single unified system. The access control list (ACL) evaluation mechanism supports both enterprise-level deployed instances and cloud-based multi-tenant scenarios, allowing the same system to adapt to different usage patterns without requiring separate optimized versions for each model.
Solution Approach 2:
The system employs dynamic access control evaluation where the ACL is not statically configured but evaluated at runtime based on the subject, object, and action being performed. This dynamic approach allows the system to adapt to different usage models by evaluating permissions in context rather than relying on pre-configured static access rules for each usage scenario.
2Adaptability or versatility
If access control mechanisms are made robust and flexible to accommodate cloud-based systems, then adaptability improves, but system complexity increases
Solution Approach 1:
The patent segments the access control functionality into distinct components: the access control list (ACL) storing permission statements, the evaluation mechanism that processes these statements, and the data model that records changes to objects and subjects. This segmentation allows each component to be independently optimized and managed, reducing overall system complexity while maintaining robustness and flexibility.
Solution Approach 2:
The patent introduces an intermediary evaluation mechanism that sits between the stored permission statements and the access control decisions. This intermediary layer processes and evaluates the permission statements according to a defined data model, shielding the rest of the system from the complexity of interpreting and enforcing diverse access policies while enabling flexible cloud-based access control.
3Speed
If the system records information about changes to objects and subjects efficiently, then data retrieval speed improves, but the amount of data to be managed increases
Solution Approach 1:
The patent implements preliminary action by maintaining a structured data model that pre-organizes information about changes to objects and subjects. Instead of recording all possible change information indiscriminately, the system pre-defines the relevant change attributes and structures them in a query-optimized format, enabling fast retrieval without managing excessive data volumes.
Solution Approach 2:
The patent applies local quality by recording change information with specific relevance to access control evaluations. Rather than uniformly recording all possible attributes of objects and subjects, the system selectively records only the change information that is locally relevant to permission evaluation, reducing data volume while maintaining retrieval speed for access control operations.
Data Source
AI summary
The disclosed technology addresses the need in the art for a content management system that can be highly flexible to the needs of its subjects. The present technology permits any object to be shared by providing a robust and flexible access control list mechanism. The present technology utilizes a data structure that is highly efficient that both minimizes the amount of information that needs to be written into any database, but also allows for fast reads and writes of information from authoritative tables that are a source of truth for the content management system, while allowing for maintenance of indexes containing more refined data that allow for efficient retrieval of certain information that would normally need to be calculated when it is needed.