Link Service for File System Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content management systems face challenges in consistently managing access to objects via links due to the lack of tight coupling with the file system, leading to inconsistencies in access control and limited flexibility in link sharing, as links often do not have a known subject in the file system, making it difficult to determine access permissions.
Innovation Solution
The solution identifies a link as a subject in the file system, allowing it to be granted rights in the access control list, enabling the file system to directly evaluate access permissions, and introduces a link service that can manage links, perform logging, and enforce additional policies, thus simplifying access control and enhancing flexibility in link sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If links are not tightly coupled to the file system, then link sharing flexibility is improved, but access control consistency deteriorates
Solution Approach 1:
The patent introduces a link service as an intermediary layer between links and the file system. This service manages links independently while maintaining access control consistency by translating link-based access requests into file system-compatible access control list (ACL) entries. The link service acts as a mediator that preserves both link sharing flexibility and file system access control consistency without requiring tight coupling.
2Measurement precision
If additional logic is added to determine link validity and access permissions, then access control accuracy is improved, but system complexity increases
Solution Approach 1:
The patent extracts the complex access control logic for links from the core file system and places it in a dedicated link service. This separation allows the file system to maintain its simple subject-based access control model while the link service handles the specialized logic for determining link validity, verifying link holders, and managing link-specific access permissions. The complexity is isolated rather than distributed throughout the system.
Solution Approach 2:
The link service autonomously manages link validation and access permission determination without requiring complex integration with the file system's access control mechanisms. It independently evaluates link validity, identifies proper link holders, and translates these determinations into file system ACL entries, thereby achieving accurate access control through self-contained logic rather than system-wide complexity.
3Adaptability or versatility
If a link caller is not known to the file system, then link anonymity is improved, but access permission determination becomes difficult
Solution Approach 1:
The link service serves as an intermediary that bridges anonymous link callers and the file system's subject-based access control model. When a link caller accesses a link, the link service creates a temporary subject identity representing the link, translates the access request into file system ACL terms, and handles the permission determination. This allows anonymous callers to access links while maintaining consistent access control through the link service's mediation, without requiring the file system to directly recognize or manage anonymous identities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present technology pertains to a link service that can create, maintain, and service links to objects on behalf of a content management system or other services. The link service can share administration of links with other services when desired or can even allow other services to issue the link and manage the object that is the subject of the link while providing other functions to support the link. Additionally, link service can interface with a file system that can support links as actors in the file system, whereby greater control and flexibility in supporting links is provided. Link service can also accommodate servicing and management of links issued by legacy services, where the legacy services have unique link logic that should still be utilized to maintain a consistent user experience.