Systems and methods for facilitating access to private files using a cloud storage system

• US 10,037,434 B2
• Filed: 01/29/2016
• Issued: 07/31/2018
• Est. Priority Date: 10/12/2012
• Status: Active Grant

• Current Assignee: Egnyte Incorporated
• Original Assignee: Egnyte Incorporated
• Inventors: Ancin, Hakan, Chen, Xi, Jassal, Amrit, Jung, Daniel H., Neustaetter, Gregory B., Puttergill, Sean H., Sundararaj, Ramakrishnan, Vedanthan, Sanjay, Yalangi, Chandra, Kavasseri, Ramanathan, Wijayaratne, Ravi, Sharma, Shishir
• Primary Examiner(s): Boutah, Alina A
• Application Number:
  US15/010,415
• Publication Number:
  US 20160149888A1
• Time in Patent Office: 914 Days
• Field of Search: 709223, 709217, 709219, 709225, 709229, 709243, 709249, 709213, 709203, 70799901, 707610
• CPC Class Codes: G06F 15/17331 Distributed shared memory [DSM], e.g. remote direct memory access [RDMA]
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/14 Details of searching files based on file metadata
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: G06F 16/1844 Management specifically adapted to replicated file systems
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method for providing access to objects associated with a particular client in a cloud storage system is disclosed. The method includes the steps of establishing a connection with a user, providing a client namespace associated with the client to the user, where the client namespace represents objects stored on the cloud storage system and objects stored on a private storage system apart from the cloud storage system, receiving a request from the user to access an object stored on the private storage system, and providing information to the user to facilitate access to the object stored on the private storage system by said user. Other systems and methods are also disclosed. Important advantages of the present invention are facilitated by separating the logic for user access (control plane) from the actual storage (Storage plane). Private file system access can still be managed from the cloud, while keeping the client data private.

Claims

1. In a cloud storage system, a method for providing access to objects associated with a client, said method comprising:

establishing a connection with a user associated with said client over a network;

providing a client namespace associated with said client to said user via said connection, said client namespace including information representing objects of a cloud file system stored on said cloud storage system and information being indicative of portions of a private file system stored on a private storage system but not on said cloud storage system, said private storage system being located remotely from said cloud storage system;

receiving a request from said user, based on said client namespace, to access a portion of said private file system stored on said private storage system; and

providing access information to said user responsive to said request to access said portion of said private file system, said access information enabling said user to establish a separate connection with said private storage system and to access said portion of said private file system via said separate connection.

2. The method of claim 1, wherein said access information includes connection information enabling said user to establish said separate connection with said private storage system.

3. The method of claim 2, wherein said connection information includes HTTP endpoint information associated with said private storage system.

4. The method of claim 3, wherein said endpoint information indicates a read-only endpoint.

5. The method of claim 1, wherein said step of providing access information to said user responsive to said request includes redirecting said user to said private storage system.

6. The method of claim 1, wherein:

said step of providing said client namespace includes providing a client namespace further including information being indicative of portions of a second private file system stored on a second private storage system but not on said cloud storage system, said second private storage system being located remotely from said cloud storage system; and

said method further comprises the steps of

receiving a second request from said user, based on said client namespace, to access a portion of said second private file system; and

providing second access information to said user responsive to said second request, said second access information enabling said user to establish a second separate connection with said second private storage system and to access said portion of said second private file system via said second separate connection.

7. The method of claim 6, wherein:

said step of providing said client namespace to said user includes providing a first portion of said client namespace to said user based on objects stored on said cloud storage system;

said access information enables said user to retrieve a second portion of said client namespace from said private storage system; and

said second access information enables said user to retrieve a third portion of said client namespace from said second private storage system.

8. The method of claim 1, wherein said access information enables said user to retrieve a private portion of said client namespace from said private storage system.

9. A cloud storage system for providing access to objects associated with a client, said cloud storage system comprising:

memory for storing data and code;

at least one processing unit for executing said code, said code including a namespace module operative to

provide a client namespace associated with said client, said client namespace including information representing objects of a cloud file system stored on said cloud storage system and information being indicative of portions of a private file system stored on a private storage system but not on said cloud storage system, said private storage system being located remotely from said cloud storage system and

provide access information to facilitate access to a portion of said private file system via said private storage system; and

at least one network interface operative to

establish a network connection with a user associated with said client,

provide said client namespace to said user via said network connection,

receive a request from said user, based on said client namespace, to access said portion of said private file system, and

provide said access information to said user, said access information enabling said user to establish a separate connection with said private storage system and to access said portion of said private file system via said separate connection.

10. The system of claim 9, wherein said access information includes connection information enabling said user to establish said separate connection with said private storage system.

11. The system of claim 10, wherein said connection information includes HTTP endpoint information associated with said private storage system.

12. The system of claim 11, wherein said endpoint information indicates a read-only endpoint.

13. The system of claim 9, wherein said namespace module is further operative to redirect said user to said private storage system in response to said network interface receiving said request from said user to access said portion of said private file system.

14. The system of claim 9, wherein said namespace module is further operative to:

provide a client namespace further including information being indicative of portions of a second private file system stored on a second private storage system but not on said cloud storage system, said second private storage system being located remotely from said cloud storage system; and

provide second access information to said user, said second access information enabling said user to establish a second separate connection with said second private storage system and to access a portion of said second private file system via said second separate connection.

15. The system of claim 14, wherein:

said namespace module is further operative to provide a first portion of said client namespace to said user based on objects stored on said cloud storage system;

said access information enables said user to retrieve a second portion of said client namespace from said private storage system; and

said second access information enables said user to retrieve a third portion of said client namespace from said second private storage system.

16. The system of claim 9, wherein said access information enables said user to retrieve a private portion of said client namespace from said private storage system.

17. A cloud storage system for providing access to objects associated with a client, said cloud storage system comprising:

memory for storing data and code;

at least one processing unit for executing said code;

means for providing a client namespace including information representing objects of a cloud file system stored on said cloud storage system and information being indicative of portions of a private file system stored on a private storage system but not on said cloud storage system, said private storage system being located remotely from said cloud storage system;

means for providing access information to facilitate access to a portion of said private file system via said private storage system; and

at least one network interface operative to

establish a network connection with a user associated with said client,

provide said client namespace to said user via said network connection,

receive a request from said user, based on said client namespace, to access said portion of said private file system, and

provide said access information to said user, said access information enabling said user to establish a separate connection with said private storage system and to access said portion of said private file system via said separate connection.

18. A non-transitory, electronically-readable storage medium having code embodied therein for causing an electronic device to perform a method for providing access to objects associated with a client, said code being operative to cause said electronic device to:

establish a connection with a user associated with said client over a network;

provide a client namespace associated with said client to said user via said connection, said client namespace including information representing objects of a cloud file system stored on said cloud storage system and information being indicative of portions of a private file system stored on a private storage system but not on said cloud storage system, said private storage system being located remotely from said cloud storage system;

receive a request from said user, based on said client namespace, to access a portion of said private file system stored on said private storage system; and

provide access information to said user responsive to said request to access said portion of said private file system, said access information enabling said user to establish a separate connection with said private storage system and to access said portion of said private file system via said separate connection.