Generating a stub file corresponding to a classified data file

• US 10,114,962 B2
• Filed: 05/18/2016
• Issued: 10/30/2018
• Est. Priority Date: 06/02/2015
• Status: Active Grant

• Current Assignee: Alibaba Group Holding Ltd.
• Original Assignee: Alibaba Group Holding Ltd.
• Inventors: Lin, Changxiong
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US15/158,423
• Publication Number:
  US 20160357978A1
• Time in Patent Office: 895 Days
• Field of Search: 726 30
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 3/06 Digital input from, or digital output to, record carriers , e.g. RAID, emulated record carriers or networked record carriers
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 69/00 Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass networks security protocols H04L9/40; wireless communication networks H04W

Abstract

Protecting data files is disclosed, including: in response to an indication that a data file has been generated by a client device, determining a security classification associated with the data file; determining that the security classification associated with the data file comprises a classified file; storing the data file in a designated virtual storage area; and generating a stub file at an original storage location of the data file, wherein the stub file includes a viewing permission associated with the data file and a storage location of the data file in the designated virtual storage area.

Claims

1. A method, comprising:

in response to an indication that a data file has been generated by a first client device, determining a security classification associated with the data file;

determining that the security classification associated with the data file comprises a classified file;

storing, using one or more processors, the data file in a designated virtual storage area;

generating a first stub file at an original storage location of the data file, wherein the first stub file includes a viewing permission associated with the data file and a storage location of the data file in the designated virtual storage area;

receiving a first instruction from a first user to share the data file with a second user;

determining user information associated with the second user;

determining that the second user has permission to access the data file based at least in part on the user information associated with the second user; and

sending a second instruction to a second client device associated with the second user, wherein the second instruction is configured to generate a second stub file corresponding to the data file at the second client device associated with the second user, wherein the second stub file is configured to be usable to obtain the data file in the designated virtual storage area.

2. The method of claim 1, wherein the designated virtual storage area is associated with a cloud server.

3. The method of claim 1, wherein determining the security classification associated with the data file comprises:

comparing content information associated with the data file against a preset condition; and

determining the security classification based at least in part on a result of the comparison.

4. The method of claim 1, wherein the security classification associated with the data file is set by a third user.

5. The method of claim 1, further comprising storing the first stub file at the original storage location associated with the data file.

6. The method of claim 1, further comprising:

receiving a user selection associated with the first stub file to access the data file;

determining whether a third user associated with the user selection has permission to access the data file;

in the event that the third user has permission to access the data file, executing a virtual application corresponding to the data file; and

providing access to the data file at the designated virtual storage area using the virtual application.

7. The method of claim 1, further comprising:

receiving a user selection associated with the first stub file to access the data file;

determining whether a third user associated with the user selection has permission to access the data file;

in the event that the third user has permission to access the data file, executing a virtual application corresponding to the data file; and

providing access to the data file at the designated virtual storage area using the virtual application including by;

transmitting information included in the first stub file to a cloud server associated with the designated virtual storage area; and

receiving a user interface associated with a document editor program from the cloud server.

8. The method of claim 1, further comprising:

receiving a user selection associated with the first stub file to access the data file;

determining whether a third user associated with the user selection has permission to access the data file;

in the event that the third user has permission to access the data file, executing a virtual application corresponding to the data file; and

providing access to the data file at the designated virtual storage area using the virtual application including by;

transmitting information included in the first stub file to a cloud server associated with the designated virtual storage area;

receiving a user interface associated with a document editor program from the cloud server;

receiving an operation to be performed on the data file via the user interface; and

sending the operation to the cloud server.

9. A computer program product, the computer program product comprising a non-transitory computer readable storage medium and comprising computer instructions for:

in response to an indication that a data file has been generated by a first client device, determining a security classification associated with the data file;

determining that the security classification associated with the data file comprises a classified file;

storing the data file in a designated virtual storage area;

generating a first stub file at an original storage location of the data file, wherein the first stub file includes a viewing permission associated with the data file and a storage location of the data file in the designated virtual storage area;

receiving a first instruction from a first user to share the data file with a second user;

determining user information associated with the second user;

determining that the second user has permission to access the data file based at least in part on the user information associated with the second user; and

sending a second instruction to a second client device associated with the second user, wherein the second instruction is configured to generate a second stub file corresponding to the data file at the second client device associated with the second user, wherein the second stub file is configured to be usable to obtain the data file in the designated virtual storage area.

10. The computer program product of claim 9, wherein the designated virtual storage area is associated with a cloud server.

11. The computer program product of claim 9, wherein determining the security classification associated with the data file comprises:

comparing content information associated with the data file against a preset condition; and

determining the security classification based at least in part on a result of the comparison.

12. The computer program product of claim 9, wherein the security classification associated with the data file is set by a third user.

13. The computer program product of claim 9, further comprising storing the first stub file at the original storage location associated with the data file.

14. The computer program product of claim 9, further comprising:

receiving a user selection associated with the first stub file to access the data file;

determining whether a third user associated with the user selection has permission to access the data file;

in the event that the third user has permission to access the data file, executing a virtual application corresponding to the data file; and

providing access to the data file at the designated virtual storage area using the virtual application.

15. The computer program product of claim 9, further comprising:

receiving a user selection associated with the first stub file to access the data file;

determining whether a third user associated with the user selection has permission to access the data file;

in the event that the third user has permission to access the data file, executing a virtual application corresponding to the data file; and

providing access to the data file at the designated virtual storage area using the virtual application including by;

transmitting information included in the first stub file to a cloud server associated with the designated virtual storage area; and

receiving a user interface associated with a document editor program from the cloud server.

16. The computer program product of claim 9, further comprising:

receiving a user selection associated with the first stub file to access the data file;

determining whether a third user associated with the user selection has permission to access the data file;

in the event that the third user has permission to access the data file, executing a virtual application corresponding to the data file; and

providing access to the data file at the designated virtual storage area using the virtual application including by;

transmitting information included in the first stub file to a cloud server associated with the designated virtual storage area;

receiving a user interface associated with a document editor program from the cloud server;

receiving an operation to be performed on the data file via the user interface; and

sending the operation to the cloud server.

17. A system, comprising:

one or more processors configured to;

in response to an indication that a data file has been generated by a first client device, determine a security classification associated with the data file;

determine that the security classification associated with the data file comprises a classified file;

store the data file in a designated virtual storage area;

generate a first stub file at an original storage location of the data file, wherein the first stub file includes a viewing permission associated with the data file and a storage location of the data file in the designated virtual storage area;

receive a first instruction from a first user to share the data file with a second user;

determine user information associated with the second user;

determine that the second user has permission to access the data file based at least in part on the user information associated with the second user; and

send a second instruction to a second client device associated with the second user, wherein the second instruction is configured to generate a second stub file corresponding to the data file at the second client device associated with the second user, wherein the second stub file is configured to be usable to obtain the data file in the designated virtual storage area; and

one or more memories coupled to the one or more processors and configured to provide instructions to the one or more processors.

18. The system of claim 17, wherein the designated virtual storage area is associated with a cloud server.