Recursive Application Access Control for Cloud Storage Folders
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mechanisms for managing third-party application access to cloud storage do not allow users to configure specific access control for folders or contents, often resulting in overly broad or restrictive access, making it tedious to grant access to specific file types or folders.
Innovation Solution
A system and method for recursive propagation of application access control, where access authorization to a parent folder is modified and propagated to child folders based on common attributes, allowing third-party applications to access content files without requiring explicit authorization for each subfolder.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users grant access to all files of a particular type, then third-party applications can access content easily, but access control becomes too broad and less secure
Solution Approach 1:
The patent implements folder-specific access control rules that allow different applications to have different access permissions to different folders. Instead of applying a uniform access rule to all files of a particular type, the system enables users to configure access control on a per-folder basis, thereby achieving both ease of operation and security through localized access policies.
2Reliability
If users configure access control for each file individually, then access control becomes precise and secure, but the process becomes tedious and time-consuming
Solution Approach 1:
The patent merges access control rules at the folder level, allowing users to configure access permissions once for a parent folder and have those rules automatically propagated to all child folders and files within that folder. This consolidation approach maintains precise access control while dramatically reducing the time and effort required for configuration.
Solution Approach 2:
The system performs preliminary action by automatically propagating access control rules from parent folders to child folders before any access requests are made. This pre-configuration approach eliminates the need for users to manually set up access control for each individual file or subfolder, thereby saving time while maintaining security precision.
3Ease of operation
If users store content in locations private to specific applications, then access control for that application is simplified, but content becomes inaccessible to other applications
Solution Approach 1:
The patent implements a universal access control system where folders can be configured with access rules that apply to multiple applications simultaneously. Instead of requiring separate private locations for each application, the system allows a single folder to serve multiple applications with different access permissions, thereby achieving both ease of operation and multi-application accessibility.
Data Source
AI summary
A method includes receiving, at a cloud storage system, a request to access a file from an external application on behalf of a first user account, determining, based on one or more access control lists (ACLs) associated with a shared folder, that the external application is not allowed to access the file on behalf of the first user account, and receiving, from a user device associated with the first user account, a message authorizing the external application to access the file on behalf of the first user account. The method further includes modifying the ACLs associated with the shared folder containing the file and a subfolder, and allowing the external application to access the file on behalf of the first user account based on the user information of the first user account and the application information of the external application in the modified ACLs.