Hosted Storage Access Control List Assignment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hosted storage systems lack efficient mechanisms for managing and assigning access permissions across multiple data objects, leading to complexities in controlling access and updating permissions.
Innovation Solution
Implementing a method where a data object with an access control list can be used as a reference or copied to assign permissions to other data objects, allowing for efficient management and updating of access permissions across multiple objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control lists are stored separately for each data object, then access permissions can be precisely controlled for each object, but the complexity of managing permissions across multiple objects increases significantly
Solution Approach 1:
The patent applies universality by enabling a single access control list to serve multiple data objects simultaneously. The system allows one ACL to be assigned as the access control list for multiple data objects, meaning one ACL performs the function of controlling access for many objects rather than requiring separate ACLs for each object. This reduces the number of ACLs that need to be managed while maintaining precise access control.
Solution Approach 2:
The patent applies copying by allowing the system to copy an existing access control list and assign it to multiple data objects. Instead of creating unique ACLs for each object, the system can replicate a template ACL across multiple objects, ensuring consistent permission management while reducing the administrative burden of creating and maintaining individual ACLs for each data object.
2Reliability
If access control lists are updated for each data object individually, then precise permission updates are achieved, but the time and effort required to update permissions across multiple objects increases
Solution Approach 1:
The patent enables a single ACL to function for multiple data objects, which means that when permissions need to be updated, the update is applied to the shared ACL rather than requiring individual updates to each object's ACL. This universal assignment allows one update action to affect multiple objects simultaneously, maintaining precise permission control while dramatically reducing the time and effort required for updates.
Solution Approach 2:
The patent allows administrators to pre-configure access control lists that can be reused across multiple data objects. By preparing ACLs in advance and assigning them to multiple objects beforehand, the system eliminates the need for repetitive update operations later. When permission changes are needed, they are applied to the pre-configured ACL that already serves multiple objects, reducing update time and effort.
3Reliability
If multiple access control lists are maintained for different data objects, then fine-grained access control is achieved, but the system resources required to store and manage ACLs increase
Solution Approach 1:
The patent reduces ACL storage requirements by enabling one ACL to serve multiple data objects. Instead of storing separate ACLs for each object, the system stores a single ACL that is referenced by multiple objects. This universal assignment maintains fine-grained access control capabilities while significantly reducing the quantity of ACL data that needs to be stored and managed in the system.
Solution Approach 2:
The patent applies copying by allowing the system to replicate references to the same ACL across multiple data objects rather than storing duplicate ACL content. The system can copy the reference or pointer to the ACL multiple times, assigning it to different objects without duplicating the actual ACL data. This approach maintains access control granularity while minimizing the storage resources required for ACLs.
Data Source
AI summary
A data object is stored in a hosted storage system and includes an access control list specifying access permissions for data object stored in the hosted storage system. The hosted storage system provides hosted storage to a plurality of clients that are coupled to the hosted storage system. A request to store a second data object is received. The request includes an indicator that the first data object stored in the hosted storage system should be used as an access control list for the second data object. The second data object is stored in the hosted storage system. The first data object is assigned as an access control list for the second data object stored in the hosted storage system.