Object Storage Data Access Control via Serverless Code Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing object storage services lack the ability to dynamically control data access and enforce data manipulations, such as removing personally identifying information, without modifying the interface or relying on end users, and face complexity in integrating serverless task executions with object storage services.
Innovation Solution
The solution involves configuring the object storage service and on-demand code execution system to stage input and output data as handles, allowing serverless tasks to manipulate data without implementing network communications, and enabling data access control code to be executed within the I/O path for dynamic access management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If object storage services allow dynamic data manipulation and access control through user-submitted code, then data security and access control are improved, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary execution environment that acts as a mediator between the object storage service and user-submitted code. This environment provides necessary computing resources and data access capabilities while enforcing security constraints and isolation boundaries. The intermediary layer handles the complexity of code execution, resource management, and security enforcement, allowing the object storage service to gain enhanced data manipulation capabilities without directly managing the complexity of executing arbitrary user code.
2Adaptability or versatility
If serverless tasks are integrated with object storage services to enable data manipulation, then functional versatility is improved, but integration complexity increases
Solution Approach 1:
The patent merges the object storage service with an on-demand code execution system into an integrated platform. The execution environment is tightly coupled with the storage service, allowing serverless tasks to directly access and manipulate stored data without requiring separate integration layers. This merging enables functionalities such as automatic data processing pipelines, embedded analytics, and custom access control logic to be implemented as part of the storage service itself, enhancing versatility while managing integration complexity through unified architecture.
3Ease of operation
If user code is executed within the I/O path of object storage service, then data access control is improved, but operational complexity increases
Solution Approach 1:
The patent implements a self-service mechanism where the execution environment automatically manages the execution of user-submitted code within the I/O path of the object storage service. The system autonomously handles code loading, environment setup, execution orchestration, and result integration without requiring manual operational intervention. This self-service approach allows data access control to be enhanced through user-defined logic while minimizing the operational complexity burden on system administrators, as the platform automatically manages the complex tasks of code execution and integration.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods are described for modifying input and output (I/O) to an object storage service by implementing one or more owner-specified functions to I/O requests. Different data manipulation functions can be placed in different I/O paths depending on the request method or user access level. For example, a user having full access may be returned the unaltered version of the object, whereas a user having modified or reduced access may be returned a modified or redacted version of the object. Additionally, data access control functions can be used to grant or deny access based on a variety of factors such as user identity, time window, prior access, keywords, geographical region, etc., or to allow access to external services or the requesting user's private resources. In this manner, owners of the object collection are provided with greater control over how the object collection is accessed.