Flexible Access Control List Mechanism for Cloud Content Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Most content management systems are optimized for specific usage models and are not flexible enough to accommodate modern cloud-based environments, lacking a robust and flexible access control mechanism that efficiently handles changes in access permissions and synchronization services.
Innovation Solution
A content management system with a flexible access permission model that allows permissions to apply to directories or specific objects, inherit from global policies, and suppress inherited permissions, using unique indexes for efficient data retrieval and storage, and a hybrid logical clock for system-wide event ordering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a content management system is optimized for a specific usage model, then it achieves high efficiency for that model, but it becomes inflexible and unsuitable for other usage models including modern cloud-based environments
Solution Approach 1:
The patent implements a universal access control mechanism that can handle multiple usage models (enterprise-level, cloud-based, collaborative environments) through a single flexible permission system. The system uses group-based access control where permissions can be inherited, suppressed, or modified based on global policies, allowing the same system to adapt to different organizational structures and cloud deployment scenarios without requiring model-specific optimization
2Adaptability or versatility
If access control mechanisms are made flexible to handle various usage models, then adaptability improves, but system complexity increases
Solution Approach 1:
The patent segments the access control system into distinct hierarchical layers: global policies at the top level, group memberships in the middle layer, and object-specific permissions at the bottom layer. Each layer operates independently but contributes to the final access decision, allowing flexibility to be achieved through modular composition rather than monolithic complexity
Solution Approach 2:
The patent introduces a suppression mechanism that acts as a counterweight to permission inheritance. When a subject suppresses inherited permissions for a specific object, it explicitly overrides the default behavior, allowing the system to maintain simplicity by assuming inheritance as the default while providing targeted exceptions only where needed
3Reliability
If the system tracks detailed access changes for synchronization, then access control accuracy improves, but storage requirements and processing overhead increase
Solution Approach 1:
The patent extracts and stores only the essential access control data: subject-group-object permission triplets and global policy definitions. By focusing on storing minimal necessary information rather than complete access histories, the system achieves accurate access control decisions while minimizing storage requirements for tracking changes
Data Source
AI summary
The disclosed technology addresses the need in the art for a content management system that can be highly flexible to the needs of its subjects. The present technology permits any object to be shared by providing a robust and flexible access control list mechanism. The present technology utilizes a data structure that is highly efficient that both minimizes the amount of information that needs to be written into any database, but also allows for fast reads and writes of information from authoritative tables that are a source of truth for the content management system, while allowing for maintenance of indexes containing more refined data that allow for efficient retrieval of certain information that would normally need to be calculated when it is needed.