File system content based security

• US 10,467,424 B2
• Filed: 10/12/2017
• Issued: 11/05/2019
• Est. Priority Date: 10/12/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Mani, Anbazhagan, Patil, Sandeep, Eda, Sasikanth, Dixith, Dileep
• Primary Examiner(s): Pich, Ponnoreay
• Application Number:
  US15/730,794
• Publication Number:
  US 20190114440A1
• Time in Patent Office: 754 Days
• CPC Class Codes: G06F 16/1787 Details of non-transparently synchronising file systems
• CPC Class Codes: G06F 16/1844 Management specifically adapted to replicated file systems
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 3/065 Replication mechanisms
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes

Abstract

A filesystem command is sent by a first processor, and for synchronization by a second processor. The filesystem command is directed to a second object of a second filesystem that is synchronized with a first object of a first filesystem. An expression is sent by the first processor to the second filesystem, and for authentication by the second processor. The expression is generated based on a third object of the first filesystems that is synchronized with a fourth object of the second filesystem.

Claims

1. A method comprising:

sending, by a first processor and for synchronization by a second processor, a filesystem command directed to a second object of a second filesystem, the second object synchronized with a first object of a first filesystem; and

sending, by the first processor and for authentication by the second processor, an expression to the second filesystem, the expression generated based on a third object of the first filesystem, the third object synchronized with a fourth object of the second filesystem.

2. The method of claim 1, wherein the synchronization of the third object with the fourth object of the second filesystem is based upon receiving an update to the third object, and wherein the fourth object synchronized with the third object of the first filesystem upon receiving an update to the fourth object.

3. The method of claim 1, wherein the expression is a secondary authentication factor, and wherein the method further comprises:

sending, by the first processor and for authentication by the second processor, a primary authentication factor.

4. The method of claim 1, wherein the third object of the first filesystem is not a password.

5. The method of claim 1, wherein the third object of the first filesystem is an attribute that describes the number of files in a first folder of the first filesystem.

6. The method of claim 1, wherein the third object of the first filesystem is a metadata value.

7. The method of claim 1, wherein the method further comprises:

searching the first filesystem for a third object, the third object other than the first object;

detecting that the third object is synchronized with a fourth object of the second filesystem;

determining an attribute of the third object; and

generating a question related to the attribute and the third object, wherein the question resolves to true based on analysis by the second filesystem.

8. A tiering filesystem, the tiering filesystem comprising:

a first memory;

a first storage device, the first storage device containing a first filesystem of one or more first-filesystem objects;

a first processor, the first processor communicatively coupled to the first memory and the first storage device, the first processor configured to;

receive a first filesystem command;

detect the first filesystem command is directed to a first object of the first filesystem synchronized with a second object of a second filesystem;

retrieve, based on the detection, one or more authentication credentials;

identify the first filesystem access command is a delete command;

generate, based on the identification, a linguistic expression related to the first filesystem; and

provide to the second filesystem, the linguistic expression, the authentication credentials, and a second delete command to the second filesystem.

9. The tiering filesystem of claim 8, wherein the tiering filesystem further comprises:

a second memory;

a second storage device, the second storage device containing a second filesystem of one or more second filesystem objects synchronized with the first filesystem;

a second processor, the second processor communicatively coupled to the second memory and the second storage device, the second processor configured to;

receive the provided second delete command;

validate, based on the received second delete command, the second delete command based on the authentication credentials;

compare the linguistic expression to the second filesystem;

verify, based on the comparison, the second delete command; and

delete, based on the validated and verified delete command, the second object of the one or more second filesystem objects.

10. A system comprising:

a memory; and

a processor, the processor communicatively coupled to the memory, the processor configured to perform a method comprising;

sending, by a first processor and for synchronization by a second processor, a filesystem command directed to a second object of a second filesystem, the second object synchronized with a first object of a first filesystem; and

sending, by the first processor and for authentication by the second processor, an expression to the second filesystem, the expression generated based on a third object of the first filesystem, the third object synchronized with a fourth object of the second filesystem.

11. The system of claim 10, wherein the synchronization of the third object with the fourth object of the second filesystem is based upon receiving an update to the third object, and wherein the fourth object synchronized with the third object of the first filesystem upon receiving an update to the fourth object.

12. The system of claim 10, wherein the expression is a secondary authentication factor, and wherein the method further comprises:

sending, by the first processor and for authentication by the second processor, a primary authentication factor.

13. The system of claim 10, wherein the third object of the first filesystem is not a password.

14. The system of claim 10, wherein the third object of the first filesystem is an attribute that describes the number of files in a first folder of the first filesystem.

15. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to:

send, by a first processor and for synchronization by a second processor, a filesystem command directed to a second object of a second filesystem, the second object synchronized with a first object of a first filesystem; and

send, by the first processor and for authentication by the second processor, an expression to the second filesystem, the expression generated based on a third object of the first filesystem, the third object synchronized with a fourth object of the second filesystem.

16. The computer program product of claim 15, wherein the synchronization of the third object with the fourth object of the second filesystem is based upon receiving an update to the third object, and wherein the fourth object synchronized with the third object of the first filesystem upon receiving an update to the fourth object.

17. The computer program product of claim 15, wherein the expression is a secondary authentication factor, and the program instructions are executable by the computer to further cause the computer to:

send, by the first processor and for authentication by the second processor, a primary authentication factor.

18. The computer program product of claim 15, wherein the third object of the first filesystem is not a password.

19. The computer program product of claim 15, wherein the third object of the first filesystem is an attribute that describes the number of files in a first folder of the first filesystem.

20. The computer program product of claim 15, wherein the third object of the first filesystem is a metadata value.