File Server Access Control Using Virtual File System Rule Sets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current file server systems face high computational costs and delays due to the need to parse pathnames for access control authentication, especially under heavy loads, as they implement access controls on a per pathname basis using export lists.
Innovation Solution
Implementing access controls on a per Virtual File System (VFS) basis using path-independent export rule sets, where each rule set consists of ordered lists of network addresses and authentication rules, allowing quick identification and application of appropriate access permissions without intensive pathname processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If access controls are implemented on a per pathname basis using export lists, then access control precision is improved, but computational overhead and processing time increase significantly
Solution Approach 1:
The patent segments the access control mechanism into two distinct components: (1) pathname-based export lists that provide precise access control decisions, and (2) directory-based caching that provides rapid lookup. By dividing the access control process into these separate functional segments, the system maintains the precision of pathname-based controls while eliminating their computational burden through caching.
Solution Approach 2:
The system performs preliminary action by pre-computing and caching the results of access control decisions in directory-based cache entries before they are actually needed. When a pathname is resolved, the system first checks the cache for pre-computed access control information, allowing rapid authentication without repeating the full pathname-based export list evaluation process.
2Measurement precision
If pathname parsing is performed for every access request, then access control accuracy is maintained, but system performance degrades under heavy loads
Solution Approach 1:
The patent applies preliminary action by pre-computing access control decisions and storing them in directory-based cache entries before they are needed. The cache entries contain pre-evaluated access control information that can be rapidly retrieved without repeating the expensive pathname parsing and export list matching process, thereby maintaining accuracy while reducing authentication delay.
Solution Approach 2:
The system creates simplified copies of access control information in the directory-based cache. Instead of storing and re-evaluating the complete pathname and export list combinations, the system copies only the essential access control decisions and network address information into cache entries, enabling rapid lookup while preserving the accuracy of the original access control logic.
3Reliability
If export lists are used for access control, then per-pathname security is achieved, but device complexity and computational cost increase
Solution Approach 1:
The patent segments the access control architecture into distinct functional components: export lists that define security policies, pathname resolution that identifies targets, and directory-based caching that stores pre-computed access decisions. This segmentation allows each component to be optimized independently, maintaining security enforcement while reducing the complexity of the overall access control mechanism.
Solution Approach 2:
The directory-based cache serves as an intermediary between the complex export list definitions and the simple access decisions. It mediates by pre-computing access control results based on export lists and pathnames, then providing simplified cached entries for rapid authentication, thereby reducing the complexity encountered during actual access operations while maintaining the security guarantees of the original export list mechanism.
Data Source
AI summary
A system and method for limiting access using file-level protocol rule sets. A rule set, comprising of an ordered set of rules, is associated with a virtual file system (VFS). When a data access request is received, the network address of the client originating the data access request is utilized to select a matching rule from the rule set for use in determining access to the VFS. The selected rule is then processed to determine if the data access request is permitted.