Just-in-time Data Object Permission Restriction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Complex data storage systems face inefficiencies in processing file-related requests due to their scale and complexity, leading to increased resource consumption and delays in accessing or managing files, especially when implementing permission constraints.
Innovation Solution
A method and system that intercept user requests, query data stores for pending permission constraints, and implement constraints only when necessary, allowing for delayed action on permission changes and file deletions based on predefined time periods or events, using a background process to manage follow-on actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If permission constraints are applied to files in a complex storage system, then security and access control are improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent introduces an intermediary permission constraint mechanism that sits between the user request and the file system operations. This intermediary layer intercepts requests, evaluates permission constraints, and only allows operations that satisfy the constraints, thereby improving security without fundamentally changing the core file system structure.
Solution Approach 2:
The permission constraint system is segmented into distinct components: constraint definition, constraint storage, constraint evaluation, and follow-on action management. This segmentation allows each component to be optimized independently and reduces the complexity burden on the overall system.
2Reliability
If permission constraints are immediately applied upon definition, then access control is enforced timely, but system resources are consumed unnecessarily for constraints that may not be needed
Solution Approach 1:
The system dynamically determines whether to apply permission constraints based on the actual requests received. Instead of immediately applying all constraints upon definition, the system waits to see if there are actual access requests that need to be controlled, thereby avoiding unnecessary resource consumption while maintaining timely enforcement when needed.
Solution Approach 2:
Permission constraints are pre-defined and stored in the data store before being applied. This preliminary action allows the system to have constraints ready when needed without actively processing or applying them until an actual request triggers their evaluation and enforcement.
3Reliability
If the system processes all file requests through permission constraint checks, then security is maintained, but processing speed and efficiency decrease
Solution Approach 1:
The system performs permission constraint checks selectively rather than universally. It only processes requests that involve files with defined permission constraints, allowing requests without constraints to be handled quickly by the standard file system path, thereby maintaining security where needed while preserving processing speed where possible.
4Reliability
If backup files are maintained in the storage system, then data loss prevention is improved, but storage system size and complexity increase
Solution Approach 1:
The system creates copies of files for backup purposes, but these copies are managed through the same permission constraint mechanism as the original files. This allows backup functionality to be added without creating a separate complex backup management system, as the existing constraint framework handles both original and backup files uniformly.
Data Source
AI summary
An instruction is received to define or modify a permission constraint corresponding to one or more file. A period of time is determined, where the period is one during which the defined or modified permission constraint is to apply to the one or more files. It is determined that the one or more files are to be deleted following completion of the period of time. A permission-instruction data set representing the permission constraint and a flag indicating that the one or more files are to be deleted following completion of the period of time are stored in a data store. It is detected that the period of time has ended. The one or more files are deleted in response to the detection.