Permissions Engine for Distributed File System Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In distributed file systems, mismatches in permission and access control semantics across different client systems can lead to confusion and frustration for users, as they expect consistent file system object permissions, but native permission schemes differ, causing access issues.

Innovation Solution

A file system engine and permissions engine are implemented to manage file system objects by associating platform permission values with file system objects, allowing access from clients with different native permission schemes, and mapping native permission values to platform permission values to ensure consistent access rights.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If distributed file systems support multiple client systems with different native permission schemes, then adaptability and versatility are improved, but permission consistency and user experience deteriorate due to mismatched access control semantics

Engineering Contradiction:

Improvecompatibility with different client permission schemesVSAvoidpermission consistency

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces a permissions engine as an intermediary component that sits between the file system engine and client systems. This permissions engine translates and reconciles different native permission schemes from various clients into a unified permission model, allowing the distributed file system to support multiple client types while maintaining consistent access control. The permissions engine acts as the mediator that resolves permission mismatches without requiring changes to the underlying file system or client systems.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the permission management functionality by separating the file system engine from the permissions engine. This segmentation allows the file system engine to focus on file operations while the permissions engine handles the complex task of reconciling different permission schemes. By dividing the system into specialized components, the patent achieves both adaptability to multiple clients and consistency in permission enforcement.

Inventive Principle:

Principle #1Segmentation

2Reliability

If a unified permission model is implemented across the distributed file system, then permission consistency is improved, but device complexity increases due to the need for mapping and translation mechanisms

Engineering Contradiction:

Improvepermission consistencyVSAvoidpermission mapping mechanism complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The permissions engine serves as a specialized intermediary that handles the complexity of permission mapping. By concentrating the translation and reconciliation logic in this dedicated component, the patent isolates the complexity from the rest of the file system. The file system engine remains relatively simple while the permissions engine absorbs the complexity of managing multiple permission schemes, achieving a balance between consistency and complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The permissions engine is designed as a universal component that can handle multiple native permission schemes from different clients through a single unified interface. This multi-functional design allows the same permissions engine to translate permissions from various client types (Windows, Unix, macOS, etc.) into the unified file system permission model, reducing overall system complexity by avoiding the need for separate handling mechanisms for each client type.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If permission translation and mapping operations are performed for every access request, then permission consistency is maintained, but computing resources and processing time are consumed

Engineering Contradiction:

Improveaccess control accuracyVSAvoidcomputing resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The permissions engine performs permission translation and mapping operations in advance, during client connection establishment or file access initialization, rather than for every individual access request. By pre-processing and caching the translated permissions, the system maintains accurate access control while reducing the computational overhead during actual file operations. This preliminary action approach ensures permission consistency is maintained without consuming excessive computing resources during normal operations.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS10162980B1Merged permission modes

Publication Date: 2018.12.25 QUMULO INC

AI summary

Embodiments are directed to managing data in a file system. A file system engine may provide a file system that includes file system objects accessible by two or more clients that use different native permission schemes. The file system engine may receive an access request from a client to access the file system objects that includes native permission values. A permissions engine provides platform permission values from a platform permission scheme associated with the file system objects. The permissions engine provides requested platform permission values based on the platform permission scheme and the native permission values included in the access request. The permissions engine compares the requested platform permission values to the platform permission values associated with the file system objects. The permissions engine provides access rights to the file system objects based on an affirmative result of the comparison.