System and method for applying a file system security model to a query system

• US 20050289354A1
• Filed: 06/28/2004
• Published: 12/29/2005
• Est. Priority Date: 06/28/2004
• Status: Active Grant

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Veritas Operating Corporation (Gen Digital Inc.)
• Inventors: Premo, Nur, Borthakur, Dhrubajyoti, Pasqua, Joseph
• Granted Patent: US 7,562,216 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A system and method for applying a file system security model to a query system. In one embodiment, the system may include a storage device configured to store data and a file system configured to manage access to the storage device, to store file system content, and to implement a first security model, where the first security model is configured to control access to the file system content. The system may further include a query system configured to query the file system content, and security mapping functionality configured to apply the first security model to the query system.

Claims

1. A system, comprising:

a storage device configured to store data;

a file system configured to manage access to said storage device, to store file system content, and to implement a first security model, wherein said first security model is configured to control access to said file system content;

a query system configured to query said file system content; and

security mapping functionality configured to apply said first security model to said query system.

2. The system as recited in claim 1, wherein said security mapping functionality includes a security converter corresponding to said first security model, wherein said security mapping functionality applying said first security model to said query system includes said security converter mapping security information corresponding to a given file system content item to a queryable format, and wherein said query system is further configured to store said mapped security information.

3. The system as recited in claim 2, wherein in response to a given query, said query system is further configured to select said given file system content item according to said given query and to convey to said security converter an indication of said given file system content item along with corresponding mapped security information, wherein said security converter is further configured to determine whether a credential of a requestor of said given query satisfies said corresponding mapped security information, and wherein said security mapping functionality is further configured to return said given file system content item to said requestor only if said credential satisfies corresponding mapped security information.

4. The system as recited in claim 3, wherein said query system is further configured to store said mapped security information in an index, and wherein selecting said given file system content item according to said given query includes selecting said given file system content item according to said index.

5. The system as recited in claim 2, wherein said file system is further configured to implement a plurality of security models each configured to control access to a respective portion of said file system content, and wherein said security mapping functionality includes a respective security converter corresponding to each of said plurality of security models.

6. The system as recited in claim 1, wherein said query system is configured to implement a second security model, and wherein applying said first security model to said query system includes mapping said first security model to said second security model.

7. The system as recited in claim 6, wherein said security mapping functionality includes a security data dictionary implemented within said query system, and wherein said second security model includes a plurality of users, a plurality of roles, and a plurality of capabilities.

8. The system as recited in claim 1, wherein at least a portion of said file system content is stored in a data format compliant with a version of Extensible Markup Language (XML) format, and wherein said query system is configured to evaluate a version of XML Query (XQuery) language.

9. The system as recited in claim 1, wherein said first security model includes functionality compliant with a version of Kerberos authentication protocol, a version of Lightweight Directory Access Protocol (LDAP), a version of Network Information Service (NIS) protocol, a version of Local Area Network Manager (LAN Manager) protocol, or a version of Active Directory protocol.

10. A method, comprising:

storing file system content;

implementing a first security model, wherein said first security model is configured to control access to said file system content; and

applying said first security model to a query system configured to query said file system content.

11. The method as recited in claim 10, wherein applying said first security model to said query system includes mapping security information corresponding to a given file system content item to a queryable format, and wherein said query system is further configured to store said mapped security information.

12. The method as recited in claim 11, further comprising:

in response to a given query, selecting said given file system content item according to said given query;

determining whether a credential of a requestor of said given query satisfies mapped security information corresponding to said given file system content item; and

returning said given file system content item to said requestor only if said credential satisfies corresponding mapped security information.

13. The method as recited in claim 12, further comprising storing said mapped security information in an index, and wherein selecting said given file system content item according to said given query includes selecting said given file system content item according to said index.

14. The method as recited in claim 11, further comprising:

implementing a plurality of security models each configured to control access to a respective portion of said file system content; and

applying each of said plurality of security models to said query system.

15. The method as recited in claim 10, wherein said query system is configured to implement a second security model, and wherein applying said first security model to said query system includes mapping said first security model to said second security model.

16. The method as recited in claim 15, wherein said second security model includes a plurality of users, a plurality of roles, and a plurality of capabilities.

17. The method as recited in claim 10, wherein at least a portion of said file system content is stored in a data format compliant with a version of Extensible Markup Language (XML) format, and wherein said query system is configured to evaluate a version of XML Query (XQuery) language.

18. The method as recited in claim 10, wherein said first security model includes functionality compliant with a version of Kerberos authentication protocol, a version of Lightweight Directory Access Protocol (LDAP), a version of Network Information Service (NIS) protocol, a version of Local Area Network Manager (LAN Manager) protocol, or a version of Active Directory protocol.

19. A computer-accessible medium comprising program instructions, wherein the program instructions are executable to:

store file system content;

implement a first security model, wherein said first security model is configured to control access to said file system content; and

apply said first security model to a query system configured to query said file system content.

20. The computer-accessible medium as recited in claim 19, wherein applying said first security model to said query system includes mapping security information corresponding to a given file system content item to a queryable format, and wherein said query system is further configured to store said mapped security information.

21. The computer-accessible medium as recited in claim 19, wherein the program instructions are further executable to:

in response to a given query, select said given file system content item according to said given query;

determine whether a credential of a requestor of said given query satisfies mapped security information corresponding to said given file system content item; and

return said given file system content item to said requestor only if said credential satisfies corresponding mapped security information.

22. The computer-accessible medium as recited in claim 21, wherein the program instructions are further executable to store said mapped security information in an index, and wherein selecting said given file system content item according to said given query includes selecting said given file system content item according to said index.

23. The computer-accessible medium as recited in claim 20, wherein the program instructions are further executable to:

implement a plurality of security models each configured to control access to a respective portion of said file system content; and

apply each of said plurality of security models to said query system.

24. The computer-accessible medium as recited in claim 19, wherein said query system is configured to implement a second security model, and wherein applying said first security model to said query system includes mapping said first security model to said second security model.

25. The computer-accessible medium as recited in claim 24, wherein said second security model includes a plurality of users, a plurality of roles, and a plurality of capabilities.

26. The computer-accessible medium as recited in claim 19, wherein at least a portion of said file system content is stored in a data format compliant with a version of Extensible Markup Language (XML) format, and wherein said query system is configured to evaluate a version of XML Query (XQuery) language.

27. The computer-accessible medium as recited in claim 19, wherein said first security model includes functionality compliant with a version of Kerberos authentication protocol, a version of Lightweight Directory Access Protocol (LDAP), a version of Network Information Service (NIS) protocol, a version of Local Area Network Manager (LAN Manager) protocol, or a version of Active Directory protocol.