Hierarchical File System Access Control with Multi-Level Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computer security schemes can only limit data access and do not prevent data from being stolen, as they rely on monitoring suspicious access patterns and use a single user identification per document repository, which is inadequate for protecting sensitive files.
Innovation Solution
A hierarchical file structure with a two-phase access scheme is implemented, where a user must authenticate access permissions for each directory level, with a publicly accessible subdirectory allowing global search permissions after initial authentication, but requiring further authentication to access lower-level subdirectories, thereby complicating unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single user identification is used per document repository, then the access scheme is simple to implement, but the security protection is insufficient and cannot prevent data theft
Solution Approach 1:
The patent segments the document repository into a hierarchical directory structure with multiple levels (root directory, intermediate directories, and leaf directories containing documents). Each directory level has its own access control list (ACL) with independent user identifiers and permissions. This segmentation allows the system to move from a single user identification to multiple user identifiers at different hierarchical levels, significantly improving security while maintaining manageable complexity through the structured organization.
2Reliability
If multiple authentication layers are implemented in the hierarchical file structure, then security protection is significantly enhanced, but the access process becomes more complex and time-consuming
Solution Approach 1:
The system performs preliminary actions by pre-establishing the hierarchical directory structure with all necessary ACLs and user identifiers before access is needed. When a user requests access, the system has already prepared the authentication path through multiple levels. Additionally, the system can cache authentication results and use session tokens to reduce repeated authentication overhead, allowing multiple authentication layers to provide enhanced security while minimizing the time loss during actual access operations.
3Reliability
If strict access permissions are enforced at each directory level, then data security is improved, but the ease of operation for authorized users decreases
Solution Approach 1:
The patent applies local quality by allowing different directories at various hierarchical levels to have customized access control policies tailored to their specific security requirements. Each directory can have its own ACL with user identifiers and permissions specific to that location. This means that authorized users experience varying levels of access convenience appropriate to each directory's security needs, rather than a uniform restrictive policy throughout the entire system. The root directory might require strict authentication while lower-level directories with publicly shareable documents might have more permissive access.
Data Source
AI summary
Methods, systems, and products are disclosed for securing access to a file system. A directory is established in a hierarchical file structure having access permission defined by a first owner. A subdirectory is established in the directory. A sub-level subdirectory is established in the subdirectory having access permissions defined by a second owner. The subdirectory is publically accessible to anyone satisfying the access permission defined by the first owner, such that a change directory system call is executed for a user in the subdirectory, even though the user has not authenticated the access permission defined by the second owner.