METHOD AND APPARATUS FOR NETWORK STORAGE ACCESS RIGHTS MANAGEMENT

• US 20100023491A1
• Filed: 10/01/2009
• Published: 01/28/2010
• Est. Priority Date: 04/04/2007
• Status: Abandoned Application

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Xu, Guojun, HUANG, Cheng
• Application Number:
  US12/571,485
• Publication Number:
  US 20100023491A1
• Time in Patent Office: Days
• US Class Current: N/A
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration

Abstract

A method for network storage access rights management operates storage access rights of network storage directories or network storage files that an authorizing user sets for an authorized user. Authorization may be set for an authorized user in the network storage access rights metadata of the authorizing user according to the storage access rights information that the authorizing user requests to operate. Accordingly, the authorized user is allowed to access network storage locations of the authorizing user. A method for network storage access control and an apparatus for network storage access rights management are also provided.

Claims

1. A method for network storage access rights management, comprising:

obtaining a request for operating network storage access rights from an authorizing user, wherein the request carries storage access rights information that the authorizing user requests to operate; and

operating storage access rights of network storage directories or network storage files that the authorizing user sets for an authorized user in network storage access rights metadata of the authorizing user according to the storage access rights information.

2. The method of claim 1, further comprising:

classifying messaging service metadata in a same application usage according to attributes of messaging services;

creating a network storage directory for each type of metadata, and associating the network storage directories with the network storage files that store the metadata.

3. The method of claim 2, wherein the network storage directories further comprise lower-level network storage directories created for lower-level data of each type of metadata.

4. The method of claim 1, wherein the storage access rights information that the user requests to operate comprises:

an identification (ID) of at least one authorized user who obtains the access rights or at least one user who is forbidden to obtain the access rights and related information of network storage directories or network storage files involved in the storage access rights information.

5. The method of claim 4, wherein the storage access rights information further comprises at least one of the following:

access rights of the network storage files or network storage directories, inheritance attributes of the access rights of the network storage files or network storage directories, lock attributes of the access rights of the network storage files or network storage directories, expiration date of the access rights of the network storage files or network storage directories, and granting date of the access rights of the network storage files or network storage directories.

6. The method of claim 1, wherein operating the storage access rights according to the storage access rights information comprises:

searching a storage authorization policy metadata file of the authorizing user, and creating, changing, or deleting storage access rights metadata associated with the ID of the authorized user or the user who is forbidden to obtain access rights in the storage authorization policy metadata associated with the related information of network storage directories or network storage files according to the storage access rights information carried in the request.

7. The method of claim 1, wherein operating the storage access rights according to the storage access rights information comprises:

searching a user access policy metadata file associated with the authorizing user, and creating or deleting user access rules associated with the ID of the authorized user or the user who is forbidden to obtain access rights in the user access rule metadata associated with the related information of network storage directories or network storage files; and

creating or deleting storage access rights metadata associated with the ID of the authorized user or the user who is forbidden to obtain access rights in the network storage metadata files associated with the user access rules according to the storage access rights information carried in the request.

8. The method of claim 1, wherein operating the storage access rights according to the storage access rights information comprises:

searching a user access policy metadata file associated with the authorizing user for user access rules associated with the ID of the authorized user or the user who is forbidden to obtain access rights in the user access rule metadata associated with the related information of network storage directories or network storage files; and

changing storage access rights metadata associated with the ID of the authorized user or the user who is forbidden to obtain access rights in the network storage metadata files associated with the user access rules according to the storage access rights information carried in the request.

9. The method of claim 1, further comprising:

deleting the storage access rights metadata from a storage authorization policy metadata file of the authorizing user when the expiration date of the storage access rights metadata associated with the ID of the authorized user is due.

10. The method of claim 1, further comprising:

deleting the storage access rights metadata from the storage access rights metadata file of the authorizing user when the expiration date of the storage access rights metadata associated with the ID of the authorized user is due; and

deleting the user access rule metadata associated with the storage access rights of the authorized user from a user access policy metadata file of the authorizing user.

11. The method of claim 1, further comprising:

notifying the authorized user associated with the network storage access rights metadata of the changed network storage access rights metadata.

12. The method of claim 11, wherein the authorized user is notified of available access modes when notified of the changed storage access rights metadata.

13. A method for network storage access control, comprising:

obtaining a request for accessing network storages of an authorizing user from an authorized user; and

providing the authorized user with metadata accessible to the authorized user in network storage metadata files of the authorizing user according to storage access rights information of the authorized user in network storage access rights metadata of the authorizing user.

14. The method of claim 13, wherein the process of providing the authorized user with metadata accessible to the authorized user in network storage metadata files of the authorizing user according to the storage access rights information of the authorized user in the network storage access rights metadata of the authorizing user comprises:

searching a storage authorization policy metadata file of the authorizing user for storage authorization policy metadata associated with the network storage directories or network storage files of the authorizing user accessible to the authorized user, obtaining storage access rights metadata associated with the ID of the authorized user, and providing the authorized user with the metadata of network storage directories or network storage files associated with the storage access rights metadata.

15. The method of claim 13, wherein the process of providing the authorized user with metadata accessible to the authorized user in network storage metadata files of the authorizing user according to the storage access rights information of the authorized user in the network storage access rights metadata of the authorizing user comprises:

searching a user access policy metadata file of the authorizing user for user access rule metadata associated with related information of network storage directories or network storage files of the authorizing user accessible to the authorized user, and obtaining user access rules associated with the ID of the authorized user;

obtaining the storage access rights metadata associated with the ID of the authorized user in a network storage access rights metadata file according to the user access rules; and

providing the authorized user with metadata of network storage directories or network storage files associated with the storage access rights metadata.

16. The method of claim 13, further comprising:

obtaining a request for accessing network storages associated with the network storage metadata of the authorizing user from the authorized user; and

authenticating the access request from the authorized user according to the storage access rights information of the authorized user in the network storage access rights metadata of the authorizing user;

establishing a data transmission channel between the authorized user who passes the authentication and network storages of the authorizing user, and performing data transmission between the authorized user and the network storages of the authorizing user through the data transmission channel.

17. The method of claim 16, further comprising:

obtaining message contents uploaded by the authorized user by using the data transmission channel;

adding, changing or deleting network storage contents of the authorizing user according to the uploaded message contents, and updating the metadata of network storage directories or network storage files of the authorizing user according to changed information.

18. The method of claim 17, further comprising:

after updating the metadata of the network storage directories or network storage files of the authorizing user according to the message contents uploaded by the authorized user, notifying the authorizing user or the authorized user who has rights to access the network storage directories or network storage files of changed metadata.

19. An apparatus for network storage access rights management, comprising a network storage access controller and a messaging service metadata file manager, wherein:

the network storage access controller is configured to;

obtain a request for operating network storage access rights from an authorizing user, wherein the request carries the storage access rights information that the authorizing user requests to operate, and authenticate the request for operating network storage access rights from the authorizing user according to the storage access rights information in the messaging service metadata file manager; and

the messaging service metadata file manager is configured to;

based on the request for operating network storage access rights authenticated by the network storage access controller, operate storage access rights of network storage directories or network storage files that the authorizing user sets for an authorized user in network storage access rights metadata of the authorizing user according to the storage access rights information that the authorizing user requests to operate.

20. The apparatus of claim 19, wherein the messaging service metadata file manager further comprises:

a second rights withdrawing unit, configured to delete storage access rights metadata associated with the ID of the authorized user from the network storage access rights metadata file of the authorizing user when the expiration date of the storage access rights of the network storage directories or network storage files that the authorizing user sets for the authorized user is due.

21. An apparatus for network storage access rights management, comprising a network storage access controller and a messaging service metadata file manager, wherein:

the network storage access controller is configured to;

obtain a request for accessing network storages of an authorizing user from an authorized user;

authenticate the access request of the authorized user according to storage access rights information of the authorized user in network storage access rights metadata of the authorizing user in the messaging service metadata file manager;

request metadata accessible to the authorized user from the messaging service metadata file manager if the authentication succeeds, and provide the authorized user with metadata returned by the messaging service metadata file manager; and

the messaging service metadata file manager is configured to return the storage access rights information of the authorized user in the network storage access rights metadata of the authorizing user to the network storage access controller.

22. The apparatus of claim 21, wherein the messaging service metadata file manager comprises:

a first request processing unit, configured to;

search a storage authorization policy metadata file of the authorizing user for storage authorization policy metadata associated with related information of network storage directories or network storage files of the authorizing user accessible to the authorized user, and obtain storage access rights metadata associated with the ID of the authorized user; and

return the metadata of network storage directories or network storage files associated with the storage access rights metadata to the network storage access controller.

23. The apparatus of claim 21, wherein the messaging service metadata file manager comprises:

a second request processing unit, configured to;

search a user access policy metadata file of the authorizing user for user access rule metadata associated with related information of network storage directories or network storage files of the authorizing user accessible to the authorized user, and obtain user access rules associated with the ID of the authorized user;

obtain storage access rights metadata associated with the ID of the authorized user in network storage metadata files according to the user access rules; and

return the metadata of network storage directories or network storage files associated with the storage access rights metadata to the network storage access controller.

24. The apparatus of claim 21, wherein the network storage access controller is further configured to:

provide a message server with the metadata accessible to the authorized user in the network storage metadata files of the authorizing user for the authenticated access request; and

obtain message contents of the metadata accessible to the authorized user that the message server requests from a message content storage according to the metadata, and provide the obtained message contents for the authorized user.

25. The apparatus of claim 24, wherein the messaging service metadata file manager further comprises:

a data updating unit, configured to;

obtain a request from the message server, wherein the request carries message contents uploaded by the authorized user, and add, change or delete the network storage contents of the authorizing user; and

update metadata of the network storage directories or network storage files of the authorizing user according to the changed information.

26. The apparatus of claim 24, further comprising:

a notification server, configured to;

after the metadata of the network storage directories or network storage files of the authorizing user is updated according to the message contents uploaded by the authorized user, notify the authorizing user or the authorized user who has rights to access the network storage directories or network storage files of changed metadata.