Universal File Access Control System for Cloud Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in managing access control across multiple file systems and platforms, including different interfaces and segregated access control mechanisms, which complicates data migration to the cloud and poses security risks due to varied access control lists and account translation overhead.
Innovation Solution
A universal file access control system that uses a centralized access control list to manage access across various file systems, including EXT4, EXT3, EXT2, NFS, AFS, and cloud-based object storage, abstracting access control from underlying systems and providing granular control through a centralized database, with optional encryption for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If multiple different file systems are used to store data across platforms and datacenters, then data distribution and storage capacity are improved, but access control management complexity increases due to different ACL interfaces and segregated control mechanisms
Solution Approach 1:
The patent implements a universal access control system that works across multiple file systems (NTFS, NFS, AFS, GPFS, and cloud-based object storage) through a single interface. The system translates file system specific ACLs into a universal ACL format, enabling centralized management of access controls across diverse platforms and datacenters without requiring separate management for each file system type.
Solution Approach 2:
The patent introduces an intermediary translation layer that converts between different file system ACL formats and a universal ACL format. This mediator component handles the complexity of translating NTFS ACLs, NFS ACLs, AFS ACLs, and cloud object storage ACLs into a standardized universal format, shielding users from the underlying complexity of different file system access control mechanisms.
2Adaptability or versatility
If cloud migration is performed with incompatible ACL systems, then access to cloud-based object storage is enabled, but existing access controls are lost requiring recreation of user accounts and groups
Solution Approach 1:
The patent copies and translates existing ACLs from on-premise POSIX file systems to cloud-based object storage by converting them into a universal ACL format. This copying process preserves the essence of existing access controls while adapting them to the cloud environment, eliminating the need to recreate user accounts and groups.
Solution Approach 2:
The patent changes the format parameters of ACLs from file system-specific representations to a universal representation that can be stored and managed in cloud-based object storage. This parameter transformation allows existing ACLs to be migrated intact to the cloud, maintaining access control semantics across different storage environments.
3Ease of operation
If FUSE file systems are used to abstract cloud-based object storage as POSIX storage, then cloud access is simplified, but additional overhead is introduced due to management of underlying data structures
Solution Approach 1:
The patent extracts only the essential access control functionality from the FUSE file system abstraction layer, separating it from the data structure management overhead. By taking out just the ACL translation and management capabilities, the system achieves simplified cloud access without the full overhead of a complete FUSE implementation.
Solution Approach 2:
The patent implements partial abstraction by providing only the necessary access control translation layer without implementing full FUSE functionality. This partial action approach delivers the essential benefit of simplified cloud access while minimizing the overhead of managing complete file system abstraction data structures.
Data Source
AI summary
System and method for universal file access control in which a processor determines whether or not a user or process requesting access to a file has been granted an access privilege to the file by reading an access control list associated with the user or process or with a group to which the user is a member; if the user or process is determined to have been granted access privilege, retrieve stored directory descriptor information associated with the requested file; obtain a unique file handle associated with the user or process and the requested file; determine if the unique file handle has been used before by comparing the obtained unique file handle with a plurality of stored prior-used file handles; and if the unique file handle has not been used before, retrieve the requested file according to a local access protocol.