Naming Service ACL Management via MVCC Database Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing naming services in distributed file systems face challenges in achieving high availability and performance while maintaining consistency, especially when implementing access control lists (ACLs) in hierarchical structures, leading to transactional conflicts and inefficiencies.
Innovation Solution
A high-availability/high-performance naming service is implemented using a multi-version concurrency control (MVCC) database with carefully denormalized data representations and relaxed isolation levels to avoid transactional conflicts, storing namespace data in specialized tables and using a hash-based ACL system to minimize duplication and conflicts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If tree data structures are used to store namespace paths, then hierarchical organization is achieved, but transactional conflicts and duplication occur when replicating for high availability
Solution Approach 1:
The patent segments the namespace data into two separate tables: a nodes table storing path information and an ACLs table storing access control information. This segmentation allows independent replication and updating of each table, reducing transactional conflicts when maintaining consistency across replicas for high availability.
Solution Approach 2:
The patent extracts ACL information from the hierarchical tree structure and stores it in a separate flat table. This extraction eliminates the duplication problem that occurs when replicating tree structures, as the ACL table can be independently managed and replicated without affecting the namespace hierarchy consistency.
2Reliability
If ACLs are stored in hierarchical tree structures, then access control is implemented, but storage efficiency decreases due to duplication
Solution Approach 1:
The patent extracts ACL data from the hierarchical namespace structure and stores it in a separate flat table. This extraction eliminates redundant storage of ACL information across multiple tree nodes, significantly reducing the quantity of stored data while maintaining complete access control functionality.
Solution Approach 2:
Instead of copying ACL information throughout the hierarchical tree structure, the patent uses a single copy of ACL data in a flat table that can be efficiently referenced. This single-copy approach reduces storage requirements while maintaining the ability to enforce access control policies.
Data Source
AI summary
A naming service for a hierarchical namespace. The naming service includes a database system with a first table having first records. Each of the first records is for a hierarchical node and includes a node identifier and an ACL identifier to a set of access control rules applicable to the node. The database system includes a second table including second records, each record in the second records has one of the ACL identifiers from the first table correlated with a definition access control rules in the set of access control rules. The naming service includes an access control rule identifier generator configured to detect a set of access control rules for each node in the namespace and generate an a ACL identifier for each set of access control rules that can be stored in records in the first table and stored in records in the second table.