Overlay File Access Rules for Base File Integrity Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file system overlays lack robust integrity protection, particularly in scenarios where multiple stakeholders control different file systems, risking illicit modifications that compromise the integrity of the base system.
Innovation Solution
A method and system for access control that employs a hierarchical arrangement of file systems with defined integrity levels, using a rule set to determine permissible modifications between systems, including checks and alarms for unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If overlay file systems are used to allow modification of files in read-only base systems, then user accessibility and modifiability are improved, but integrity protection and security are worsened due to risk of illicit modifications
Solution Approach 1:
The patent segments the file system into hierarchical layers (base file system, overlay file systems) with distinct integrity levels. Each layer can be independently managed, allowing modifiability in upper layers while preserving integrity in the base layer through controlled access boundaries.
Solution Approach 2:
The patent introduces an intermediary verification mechanism that checks modification requests against defined rules before allowing changes to propagate to the base file system. This mediator layer enables safe modifiability while maintaining integrity protection through rule-based validation.
2Adaptability or versatility
If multiple stakeholders control different file systems in a hierarchical arrangement, then system flexibility and adaptability are improved, but access control complexity and security risk are worsened
Solution Approach 1:
The patent assigns different integrity levels and access characteristics to different file system layers based on their specific requirements. Each layer has locally optimized access control rules that match its functional needs, allowing flexible multi-stakeholder control without uniform complexity throughout the entire system.
Solution Approach 2:
The patent implements dynamic access control where rules can be selectively applied and modified based on the specific operations and contexts. This allows the system to adapt access policies in real-time without requiring complex static configurations for all possible scenarios.
3Reliability
If read-only file systems are used for base systems, then data integrity and protection are improved, but user modification capability is worsened
Solution Approach 1:
The patent nests overlay file systems on top of the read-only base file system, creating a layered structure where the base layer maintains integrity through read-only access while upper overlay layers provide modification capabilities. This nested arrangement allows both integrity protection and user modification capability to coexist.
Solution Approach 2:
The patent pre-defines access rules and integrity levels for different file system layers before operations occur. This preliminary configuration enables the system to automatically enforce integrity protection while allowing authorized modifications, eliminating the need for runtime decision-making that would compromise either integrity or usability.
Data Source
Figure 1
Figure 2
Figure 3~5
AI summary
The invention relates to a computer-implemented method, a computer-implemented device, a system, and a computer program product for access control to a first file system in an environment consisting of at least N file systems, with N ≥ 4, wherein at least two of the N file systems are arranged hierarchically relative to each other, comprising providing a rule set which contains information about whether a file of the first file system may be modified by a second and/or third and/or fourth file system arranged above the first file system, and checking, at least partially based on a comparison with the rule set, whether a modification of a file of the first file system may be carried out by the second and/or the third and/or the fourth file system.