FSVM Tag-Based Sensitive Data Control in Distributed VFS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file server systems face inefficiencies in replicating and managing sensitive data across different directories and folders, making it difficult to apply consistent data control policies due to the dispersed nature of sensitive information.
Innovation Solution
A distributed virtualized file system (VFS) with file server virtual machines (FSVMs) that scan files for predefined or user-defined patterns, apply tags, and take specific actions, allowing for consistent data control policies to be applied across files regardless of their location within the VFS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If files containing sensitive information are stored in the same directory or folder to implement access and replication policies, then policy management becomes easier, but replication efficiency decreases and flexibility is reduced when sensitive files are dispersed across different locations
Solution Approach 1:
The patent extracts the policy management function from location-based control to tag-based control. Instead of requiring files to be physically located in the same directory, the system attaches metadata tags to files containing sensitive information, allowing policy management to operate on tagged files regardless of their physical location in the distributed file system.
Solution Approach 2:
The patent implements a universal tagging mechanism that can identify and group files with sensitive information across any directory structure. The tag-based system serves multiple functions: identifying sensitive files, grouping them for policy application, and enabling efficient replication without requiring files to be physically co-located, thus providing both ease of operation and high productivity.
2Stability of the object's composition
If files with sensitive information are stored in the same location to enable consistent policy application, then data control consistency improves, but system flexibility and scalability are reduced
Solution Approach 1:
The patent introduces tags as an intermediary layer between the file system and policy management system. These tags serve as metadata that mediate the connection between dispersed files and centralized policy control, allowing consistent data control policies to be applied to tagged files anywhere in the distributed file system without requiring physical co-location or reducing system flexibility.
3Ease of manufacture
If traditional directory-based access control is used to manage sensitive data, then implementation is simpler, but it becomes difficult to manage dispersed sensitive files across different folders and shares
Solution Approach 1:
The patent extracts the identification and management of sensitive files from the directory structure itself and implements it through independent metadata tags. This allows the system to maintain simple implementation through standardized tagging while enabling easy management of dispersed files through the tag-based identification system that works across any directory or share location.
Data Source
AI summary
An example system includes a plurality of FSVMs executing at two or more computing nodes configured to cooperatively manage a distributed VFS and a system manager configured to provide a tag based on a pattern and an action associated with the tag to the plurality of FSVMs. The plurality of FSVMs are further configured to scan files of the VFS to tag files including the pattern and tag and to take the action with respect to files in the VFS having the tag.