Virtual File System Permission Framework for Cloud Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing systems face challenges in managing file permissions across different networked file system clients accessing both local and cloud storage collaboratively, leading to inconsistencies and inefficiencies.
Innovation Solution
A virtual file system with an associated permission framework is introduced, allowing for the override of original file system permissions to implement a cloud-based permission scheme. This framework uses access control lists (ACLs) and caching mechanisms to efficiently manage and enforce permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a unified permission framework is implemented to manage file permissions across cloud and local storage systems, then permission consistency and control are improved, but system complexity and performance overhead increase
Solution Approach 1:
The patent introduces a Virtual File System (VFS) layer as an intermediary between the cloud storage system and local file systems. This VFS layer acts as a mediator that translates and enforces cloud-based permission rules across different local file systems without requiring changes to the underlying storage systems. The VFS intercepts file access operations, evaluates permissions against cloud-defined rules, and either permits or denies access accordingly, thereby achieving unified permission management without direct modification of existing file systems.
Solution Approach 2:
The permission management system is segmented into separate functional components: a cloud storage system that defines permission policies, a VFS layer that enforces these policies, and local file systems that store actual data. This segmentation allows each component to operate independently while maintaining overall permission consistency. The VFS layer can be implemented as a separate module that can be loaded or unloaded without affecting the cloud storage system or local file systems.
2Reliability
If permission enforcement is performed repeatedly for each file access operation, then security is maintained, but processing time and system performance deteriorate
Solution Approach 1:
The system performs preliminary actions by pre-resolving permission rules and caching the results before actual file access operations occur. The VFS layer maintains a cache of resolved permission decisions that can be quickly retrieved during file access, avoiding the need to re-evaluate complex permission rules for each access operation. This preliminary resolution of permission logic significantly reduces processing time while maintaining security.
Solution Approach 2:
The patent implements a caching mechanism that creates a copy of the permission decision results and stores them in a cache data structure. When a file access operation occurs, the system first checks the cache for existing permission decisions rather than performing complete re-evaluation. This copying and caching of permission results allows rapid retrieval of security decisions without repeating the full enforcement processing, thereby reducing processing time while maintaining security integrity.
Data Source
AI summary
A method of managing file permissions in a remote file storage system includes defining permissions for the remote file storage system and controlling access to objects on the remote file storage system according to the permissions of the remote file storage system. The permissions are transferred to a client file storage system remote from the remote file storage system, and access to objects on the client file storage system is controlled according to the permissions of the remote file storage system. A remote file storage system includes a permissions file generator operative to generate a permissions file, which is transmitted to a client file storage system for enforcement at the client file storage system.