Link Subject Access Control in File Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content management systems face challenges in consistently managing access to objects via links, as links are not tightly coupled to the file system, leading to inconsistencies in access control and limited flexibility in sharing mechanisms.
Innovation Solution
The system identifies a link as a subject in the file system, allowing it to be treated as an actor with access rights, enabling direct access control list evaluation and flexible permission management, including inheritance and suppression of permissions, and eliminating the need for a conventional user account.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If links are not tightly coupled to the file system, then link sharing flexibility is improved, but access control consistency deteriorates
Solution Approach 1:
The patent introduces a link subject as an intermediary entity that bridges links and the file system. This link subject acts as a mediator that the file system can recognize and apply access control to, while still allowing flexible link sharing outside the traditional file system user model.
Solution Approach 2:
The link subject serves multiple functions: it represents the link in the file system for access control purposes, maintains the flexible sharing capabilities of links, and enables the file system to apply its access control logic uniformly to both traditional users and links.
2Reliability
If additional logic is added to determine link validity and access permissions, then access control consistency is improved, but system complexity increases
Solution Approach 1:
The link subject enables the file system to self-serve access control for links using its existing access control logic. Instead of requiring external link validation logic, the file system can directly evaluate access control lists against the link subject, making the system self-sufficient and reducing overall complexity.
3Ease of manufacture
If links are treated as conventional user accounts, then access control implementation is simplified, but link-specific flexibility is lost
Solution Approach 1:
The patent segments the link functionality into a distinct link subject entity that is separate from conventional user accounts. This segmentation allows the file system to treat links differently from users, applying access control uniformly while preserving link-specific characteristics and flexibility.
Data Source
AI summary
The present technology pertains to a link service that can create, maintain, and service links to objects on behalf of a content management system or other services. The link service can share administration of links with other services when desired or can even allow other services to issue the link and manage the object that is the subject of the link while providing other functions to support the link. Additionally, link service can interface with a file system that can support links as actors in the file system, whereby greater control and flexibility in supporting links is provided. Link service can also accommodate servicing and management of links issued by legacy services, where the legacy services have unique link logic that should still be utilized to maintain a consistent user experience.