Security Group Synchronization via Group Entities for Document Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing systems with separate storage systems that support different security group formats, synchronizing security group modifications can be resource-intensive, requiring individual updates to millions of documents when a user is added or removed from a group.
Innovation Solution
A synchronization service creates a unique identifier for new security groups and group entities in the second storage system, associating them with existing security groups, and updates membership changes without individually modifying user permissions across all documents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If individual user permissions are updated for all documents when synchronizing security group changes, then permission accuracy is maintained, but computing resource utilization increases significantly
Solution Approach 1:
The patent segments the permission synchronization process into two distinct layers: (1) security group level operations where group membership changes are processed, and (2) document level operations where only affected documents are updated. This segmentation allows the system to avoid the inefficient approach of updating all document permissions individually, thereby reducing computing resource utilization while maintaining permission accuracy through targeted updates.
2Reliability
If all document permissions are updated when synchronizing security group changes, then data consistency is maintained, but processing time increases
Solution Approach 1:
The patent implements preliminary action by maintaining security group definitions and membership information in the second storage system separately from document permissions. When a security group changes, the system first updates the pre-stored group definition, then uses this updated definition to efficiently determine which specific documents need permission updates. This preliminary preparation of group information enables selective document updates rather than blanket updates across all documents, significantly reducing processing time while maintaining data consistency.
3Adaptability or versatility
If security groups are synchronized from first storage system to second storage system, then security management capability is improved, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary mechanism by storing security group definitions and membership information in the second storage system as separate entities distinct from document permissions. This intermediary layer acts as a bridge between the first storage system's security groups and the second storage system's document permissions. When synchronization is needed, the intermediary group information enables the system to efficiently compute and update only the necessary document permissions, thereby providing enhanced security management capability without proportionally increasing system complexity.
Data Source
AI summary
Documents maintained by a first storage system that supports security groups are synchronized to a second storage system that supports group entities, which are incompatible with security groups. Permissions associated with the synchronized documents, including security groups, can be synchronized from the first storage system to the second storage system when a security group is created, when membership in a security group is modified, and when a security group is deleted. Synchronization of security groups in this manner can also be selectively enabled on a per-site basis or at another level of granularity.