PERFORMING AUTHORIZATION CONTROL IN A CLOUD STORAGE SYSTEM

• US 20110271353A1
• Filed: 04/28/2011
• Published: 11/03/2011
• Est. Priority Date: 04/29/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Luo, Jing J., Luo, Lin, Li, Ying, Li, Xin Hui
• Granted Patent: US 9,158,465 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/805 using a security table for the storage sub-system
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0643 Management of files
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method, apparatus and computer program product for performing authorization control in a cloud storage system. The method comprises: receiving an access request to a file block, wherein the file block is embedded with tag data comprising at least file block authorization information; retrieving the file block; extracting the file block authorization information from the tag data; determining whether the access request matches the file block authorization information; and performing the access request if the access request matches the file block authorization information. Effective authorization control may be performed in a cloud storage system.

Claims

1. A method of performing authorization control on file block access, comprising:

receiving an access request to a file block, wherein the file block is embedded with tag data comprising at least file block authorization information;

retrieving the file block;

extracting the file block authorization information from the tag data;

determining whether the access request matches the file block authorization information; and

performing the access request if the access request matches the file block authorization information.

2. The method according to claim 1, wherein the file block is periodically embedded with the tag data.

3. The method according to claim 2, wherein the period is any one of:

a quarter of a file block data volume, one eighth of a file block data volume, and one sixteenth of a file block data volume.

4. The method according to claim 1, wherein the tag data further comprises digest information of the file block authorization information.

5. The method according to claim 4, further comprising:

extracting the digest information;

determining whether the file block authorization information conforms to the digest information; and

determining whether the access request matches the file block authorization information if the file block authorization information conforms to the digest information.

6. The method according to claim 1, wherein the file block comprises file data, and the file block is a component of a file, and performing the access request comprises:

merging the file data in file blocks that constitute the file so as to perform an operation with respect to the file; and

after completion of the operation with respect to the file, embedding the tag data into the file blocks upon dividing the merged file data file into file blocks for storing.

7. The method according to claim 6, wherein merging the file data in the file blocks that constitute the file into the file so as to perform the operation with respect to the file comprises:

determining file blocks involved in the operation with respect to the file; and

merging only the file data in the involved file blocks so as to perform the operation with respect to the file.

8. The method according to claim 7, further comprising:

determining whether the operation with respect to the file causes a change of data volume of file data in the involved file blocks; and

merging file data of the involved file blocks and the subsequent file blocks if the data volume changes.

9. A computer apparatus for performing authorization control on file block access, comprising:

a computing system with at least one processor and memory;

a receiving module executing in the memory and configured to receive an access request to a file block, wherein the file block is embedded with tag data comprising at least file block authorization information.

a retrieving module executing in the memory and configured to retrieve the file block;

an extracting module executing in the memory and configured to extract the file block authorization information from the tag data;

a determining module executing in the memory and configured to determine whether the access request matches the file block authorization information; and

a performing module executing in the memory and configured to perform the access request if the access request matches the file block authorization information.

10. The apparatus according to claim 9, wherein the file block is periodically embedded with the tag data.

11. The apparatus according to claim 10, wherein the period is any one of:

a quarter of a file block data volume, one eighth of a file block data volume, and one sixteenth of a file block data volume.

12. The apparatus according to claim 9, wherein the tag data further comprises digest information of the file block authorization information.

13. The apparatus according to claim 12, further comprising:

a module executing in the memory and configured to extract the digest information;

a module executing in the memory and configured to determine whether the file block authorization information conforms to the digest information; and

a module executing in the memory and configured to determine whether the access request matches the file block authorization information if the file block authorization information conforms to the digest information.

14. The apparatus according to claim 9, wherein the file block comprises file data, and the file block is a component of the file, and the performing module comprises:

a module executing in the memory and configured to merge the file data in file blocks that constitute the file so as to perform an operation with respect to the file; and

a module executing in the memory and configured to, after completion of the operation with respect to the file, embed the tag data into the file blocks upon dividing the merged file data file into file blocks for storing.

15. The apparatus according to claim 14, wherein the module configured to merge the file data in file blocks that constitute the file into the file so as to perform the operation with respect to the file comprises:

a module executing in the memory and configured to determine file blocks involved in the operation with respect to the file; and

a module executing in the memory and configured to merge only the file data in the involved file blocks so as to perform the operation with respect to the file.

16. The apparatus according to claim 15, further comprising:

a module executing in the memory and configured to determine whether the operation with respect to the file causes a change of data volume of file data in the involved file blocks; and

a module executing in the memory and configured to merge the file data of the involved file blocks and the subsequent file blocks if the data volume changes.

17. A computer program product configured to perform authorization control on file block access, the computer program product comprising:

a bearer medium having processor executable instructions stored therein, the processor executable instructions embodied within computer readable program code, the computer readable program code comprising;

computer readable program code for receiving an access request to a file block, wherein the file block is embedded with tag data comprising at least file block authorization information;

computer readable program code for retrieving the file block;

computer readable program code for extracting the file block authorization information from the tag data;

computer readable program code for determining whether the access request matches the file block authorization information; and

computer readable program code for performing the access request if the access request matches the file block authorization information.

18. The computer program product according to claim 17, wherein the file block is periodically embedded with the tag data.

20. The computer program product according to claim 17, wherein the tag data further comprises digest information of the file block authorization information.

21. The computer program product according to claim 20, further comprising:

computer readable program code for extracting the digest information;

computer readable program code for determining whether the file block authorization information conforms to the digest information; and

computer readable program code for determining whether the access request matches the file block authorization information if the file block authorization information conforms to the digest information.

22. The computer program product according to claim 17, wherein the file block comprises file data, and the file block is a component of a file, and the computer readable program code for performing the access request comprises:

computer readable program code for merging the file data in file blocks that constitute the file so as to perform an operation with respect to the file; and

computer readable program code for \, after completion of the operation with respect to the file, embedding the tag data into the file blocks upon dividing the merged file data file into file blocks for storing.

23. The computer program product according to claim 22, wherein the computer readable program code for merging the file data in the file blocks that constitute the file into the file so as to perform the operation with respect to the file comprises:

computer readable program code for determining file blocks involved in the operation with respect to the file; and

computer readable program code for merging only the file data in the involved file blocks so as to perform the operation with respect to the file.

24. The computer program product according to claim 23, further comprising:

computer readable program code for determining whether the operation with respect to the file causes a change of data volume of file data in the involved file blocks; and

computer readable program code for merging file data of the involved file blocks and the subsequent file blocks if the data volume changes.

19. The computer program product according to claim 19, wherein the period is any one of:

a quarter of a file block data volume, one eighth of a file block data volume, and one sixteenth of a file block data volume.