Link Subject Access Control in File Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content management systems face challenges in managing links as actors within the file system, leading to inconsistencies in access control and limited flexibility in link sharing due to the lack of tight coupling between links and the file system's access control logic.
Innovation Solution
The system identifies a link as a subject within the file system, allowing it to be treated as an actor with access rights in the access control list, enabling direct evaluation of access permissions and flexible permission management, including inheritance and suppression policies, and eliminates the need for a conventional user account for link access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If links are not tightly coupled to the file system, then link sharing flexibility is improved, but access control consistency deteriorates
Solution Approach 1:
The patent introduces a link subject as an intermediary entity that bridges links and the file system. This link subject acts as a mediator that the file system recognizes, allowing links to interact with the file system's access control logic without requiring tight coupling. The link subject translates link-based access requests into file system-compatible subject identifiers, enabling consistent access control while maintaining link sharing flexibility.
2Measurement precision
If additional logic is added to determine link validity and access permissions, then access control accuracy is improved, but system complexity increases
Solution Approach 1:
The patent implements self-service by having the link subject automatically manage its own access permissions through the file system's existing access control list mechanisms. Instead of requiring external logic to continuously validate links and determine permissions, the link subject autonomously presents itself to the file system, which then applies its standard access control logic. This eliminates the need for complex external validation logic while maintaining accurate access control.
Solution Approach 2:
The patent makes the file system's access control logic universal by designing it to handle both traditional user subjects and link subjects through the same mechanisms. The access control list structure is extended to accommodate link subjects without requiring separate validation logic. This multi-functionality allows the same access control infrastructure to serve multiple purposes: traditional user access and link-based access, thereby reducing overall system complexity while maintaining accuracy.
3Reliability
If a conventional user account is required for link access, then access control security is improved, but ease of operation deteriorates
Solution Approach 1:
The link subject serves as an intermediary that decouples the need for conventional user accounts from link access. Instead of requiring link callers to have traditional user accounts with complex permission structures, the link subject abstracts this requirement by presenting itself as the accessing subject to the file system. This intermediary mechanism maintains security through the file system's existing access control checks while dramatically simplifying operation for end users who can access links without managing user accounts or permissions.
Data Source
AI summary
The present technology pertains to a link service that can create, maintain, and service links to objects on behalf of a content management system or other services. The link service can share administration of links with other services when desired or can even allow other services to issue the link and manage the object that is the subject of the link while providing other functions to support the link. Additionally, link service can interface with a file system that can support links as actors in the file system, whereby greater control and flexibility in supporting links is provided. Link service can also accommodate servicing and management of links issued by legacy services, where the legacy services have unique link logic that should still be utilized to maintain a consistent user experience.