Distributed file sharing system and a file access control method of efficiently searching for access rights

• US 20030101200A1
• Filed: 11/27/2002
• Published: 05/29/2003
• Est. Priority Date: 11/28/2001
• Status: Active Grant

• Current Assignee: OKI Electric Industry Company Limited
• Original Assignee: OKI Electric Industry Company Limited
• Inventors: Koyama, Noritaka, Wada, Kumiko
• Granted Patent: US 7,191,195 B2
• Time in Patent Office: Days
• US Class Current: 707/200
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99952 Coherency, e.g. same view to multiple users

Abstract

With a shared index information file in a file sharing index manager, a distributed file system controls access to files based on access right obtained from the index information. Even when a host terminal operated by a user does not have directory information required, that host terminal may obtain an access right from the file sharing index manager without making access to the host terminals. The host terminals perform local management via file sharing managers to minimize accesses to the host terminals which are required until processing is completed.

Claims

1. A distributed file sharing system comprising terminals acting as host terminals connected to a network and managing files, each of which contains a collection of data, stored below directories each indicating a position in a hierarchical structure, wherein

at least one of said host terminals acts in the network as a global management functional block managing all index information, the index information including access right information representative of right to access directories and files relating to sharing,

each of said host terminals including a file sharing management functional block managing the files and the directories shared by said host terminals, as well as the files locally for each host terminal, said file sharing management functional block setting and managing the access right information on directories used in managing the files.

2. The system in accordance with claim 1, wherein said global management functional block manages the index information including the access right information on all the directories for use in managing the files.

3. The system in accordance with claim 2, wherein said global management functional block controls a reference and update of the index information.

4. The system in accordance with claim 3, wherein at least one of said host terminals includes a user management functional block storing permission information on access to said host terminals as user information and managing access permission by authenticating the user information.

5. The system in accordance with claim 4, wherein said host terminals have, in a cache, a copy of a shared file managed by the index information of said global management functional block and a copy of the access right information owned by a parent directory of the file in the cache.

6. The system in accordance with claim 5, wherein said file sharing management functional block notifies said global management functional block of an update of the access right information executed locally,

said global management functional block in one of said host terminals notifying remaining ones of said host terminals, in which the access right information is stored, of the update of the access right information.

7. The system in accordance with claim 6, wherein the access right information is of a format variable in length.

8. The system in accordance with claim 7, wherein the access right information includes read right, write right, or a combination of read and write rights for stored user names and group names.

9. The system in accordance with claim 8, wherein the read right includes a permission of a reading of a file name or a directory name directly below the directory, a search through the file, a creation of the file in the cache, and a reading of the file.

10. The system in accordance with claim 8, wherein the write right includes a permission of an addition of a file or a directory directly below the directory, an update or deletion of the file, and a deletion of the directory.

11. The system in accordance with claim 8, wherein the combination of read and write rights includes:

a permission of a reading of a file name or a directory name directly below the directory, a search through the file, a creation of the file in the cache and a reading of the file;

an addition of a file or a directory directly below the directory;

an update or deletion of the file; and

a deletion of the directory

12. A method of controlling access to files in a distributed file sharing system, comprising the steps of:

preparing host terminals connected to a network and managing files, each of which contains a collection of data, stored below directories each indicating a position in a hierarchical structure;

receiving by one of the host terminals an operation request for information on either one of the directory and the file;

issuing an access request to a target to be managed in response to the operation request from the one host terminal;

checking, in response to the access request, whether or not a user has an access right to access the target right to issue the access request based on collectively managed access rights;

processing the information associated with the access request when the user has the access right;

issuing a response, when the user does not have the access right, indicating that the processing requested by the access request will not be performed;

processing index information including the access right for each of the host terminals as the target to be managed; and

providing the host terminal operated with a response signal associated with the index information processed.

13. The method in accordance with claim 12, wherein the access right includes read right, write right, or a combination of read and write rights for stored user names and group names.

14. The method in accordance with claim 13, wherein the read right includes a permission of a reading of a file name or a directory name directly below the directory, a search through the file, a creation of the file in a cache, and a reading of the file.

15. The method in accordance with claim 13, wherein the write right includes a permission of an addition of a file or a directory directly below the directory, an update or deletion of the file, and a deletion of the directory.

16. The method in accordance with claim 13, wherein the combination of read and write rights include:

a permission of a reading of a file name or a directory name directly below the directory, a search through the file, a creation of the file in the cache, a reading of the file;

an addition of a file or a directory directly below the directory;

an update or deletion of the file; and

a deletion of the directory.

17. The method in accordance with claim 12, wherein said step of checking comprises the substeps of:

checking, when the user accesses the host terminal, whether or not the user is a system administrator managing the network;

permitting access right to operate all the files if the user is the system administrator as a result of said substep of checking;

obtaining access right assigned to a group, to which the user belongs, if the user is not the system administrator as a result of the checking;

checking whether or not the host terminal on which the user is operating has parent directory information containing information on a target to be accessed;

obtaining the parent directory information from the index information on the files, including the directory, if there is no parent directory information; and

checking the access right included in the parent directory information and permitting or inhibiting the access right, depending upon a result of the checking of the access right.

18. The method in accordance with claim 14, wherein said step of checking comprises the substeps of:

checking, when the user accesses the host terminal, whether or not the user is a system administrator managing the network;

permitting access right to operate all the files if the user is the system administrator as a result of said substep of checking;

obtaining access right assigned to a group, to which the user belongs, if the user is not the system administrator as a result of the checking;

checking whether or not the host terminal on which the user is operating has parent directory information containing information on a target to be accessed;

obtaining the parent directory information from the index information on the files, including the directory, if there is no parent directory information; and

checking the access right included in the parent directory information and permitting or inhibiting the access right, depending upon a result of the checking of the access right.

19. The method in accordance with claim 15, wherein said step of checking comprises the substeps of:

checking, when the user accesses the host terminal, whether or not the user is a system administrator managing the network;

permitting access right to operate all the files if the user is the system administrator as a result of said substep of checking;

obtaining access right assigned to a group, to which the user belongs, if the user is not the system administrator as a result of the checking;

checking whether or not the host terminal on which the user is operating has parent directory information containing information on a target to be accessed;

obtaining the parent directory information from the index information on the files, including the directory, if there is no parent directory information; and

checking the access right included in the parent directory information and permitting or inhibiting the access right, depending upon a result of the checking of the access right.

20. The method in accordance with claim 16, wherein said step of checking comprises the substeps of:

checking, when the user accesses the host terminal, whether or not the user is a system administrator managing the network;

permitting access right to operate all the files if the user is the system administrator as a result of said substep of checking;

obtaining access right assigned to a group, to which the user belongs, if the user is not the system administrator as a result of the checking;

checking whether or not the host terminal on which the user is operating has parent directory information containing information on a target to be accessed;

obtaining the parent directory information from the index information on the files, including the directory, if there is no parent directory information; and

checking the access right included in the parent directory information and permitting or inhibiting the access right, depending upon a result of the checking of the access right.

21. The method in accordance with claim 17, further comprising after said substeps of:

obtaining the parent directory information the substep of checking whether or not the user is an owner of the directory;

passing, if the user is the owner, control to said substep of checking the access right; and

inhibiting the access right and terminating control if the user is not the owner.

22. The method in accordance with claim 18, further comprising after said substeps of:

obtaining the parent directory information the substep of checking whether or not the user is an owner of the directory;

passing, if the user is the owner, control to said substep of checking the access right; and

inhibiting the access right and terminating control if the user is not the owner.

23. The method in accordance with claim 19, further comprising after said substeps of:

obtaining the parent directory information the substep of checking whether or not the user is an owner of the directory;

passing, if the user is the owner, control to said substep of checking the access right; and

inhibiting the access right and terminating control if the user is not the owner.

24. The method in accordance with claim 20, further comprising after said substeps of:

obtaining the parent directory information the substep of checking whether or not the user is an owner of the directory;

passing, if the user is the owner, control to said substep of checking the access right; and

inhibiting the access right and terminating control if the user is not the owner.

25. The method in accordance with claim 12, wherein said fifth step is executed by the host terminal from which the access request was issued, one host terminal at a time.

26. The method in accordance with claim 22, wherein said step of processing the index information is executed by the host terminal from which the access request was issued, one host terminal at a time.

27. The method in accordance with claim 23, wherein said step of processing the index information is executed by the host terminal from which the access request was issued, one host terminal at a time.

28. The method in accordance with claim 24, wherein said step of processing the index information is executed by the host terminal from which the access request was issued, one host terminal at a time.