COMPUTER

• US 20130091562A1
• Filed: 10/05/2011
• Published: 04/11/2013
• Est. Priority Date: 10/05/2011
• Status: Abandoned Application

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Matsuzawa, Keiichi, Iwasaki, Masaaki
• Application Number:
  US13/264,904
• Publication Number:
  US 20130091562A1
• Time in Patent Office: Days
• US Class Current: 726/17
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

It is an object of the present invention to provide a technique for managing, in a file system that stores past images of a data file, access right to the past images.

A computer according to the present invention includes a past access control list in which access right of a user to past images and a period in which the access right is applied are described and validates accessibility to the past images using the past access control list (see FIG. 5).

Claims

1. A computer comprising:

a storing unit that stores a data file; and

a processor that reads out the data file from the storing unit, wherein the storing unit stores

a past image that is a past version of the data file, and

a present access control list in which access right of a user to the data file and access right of a user to the past image are described, and

when the processor receives an access request to the past image from the user, the processor reads out access right of the user to the past image from the present access control list and validates, according to a description of the present access control list, whether the user has right for accessing the past image.

2. The computer according to claim 1, wherein

the present access control list describes a period in which the access right of the user to the past image is applied, and

when the processor receives an access request to the past image at a certain point in the past from the user, the processor reads out access right of the user to the past image at the point from the present access control list and validates, according to a description of the present access control list, whether the user has right for accessing the past image at the point, and

if the processor is not able to read out access right of the user to the past image at the point from the present access control list, the processor determines that the user doesn'"'"'t have right for accessing the past image at the point.

3. The computer according to claim 1, wherein the processor receives a period set as a target for rewriting the access right of the user to the past image and contents of the rewriting, and collectively rewrites contents of the present access control list corresponding to the period according to the rewriting contents.

5. The computer according to claim 1, wherein

if contents of the data file and two or more images among a plurality of the past images respectively corresponding to different periods are the same, the storing unit stores the data file or the past images while a same storage area being shared by the data file or the past images,

when the data file or the past images that share the storage area are updated, the processor releases the sharing concerning the data file or the past images to be updated, secures a new storage area, and stores data that is an update target and data that is not an update target on different storage areas, and

when a request for updating access right of the user to the past image that shares a storage area with the data file or the other past images is received, the processor specifies the data file and the past image that share the storage area, temporarily suspends processing for releasing the sharing concerning the specified data file and the specified past image and updates the access right in a state in which the data file and the past image share the storage area, and thereafter resumes the processing for releasing the sharing.

6. The computer according to claim 5, wherein

the processor

specifies the data file and the past images that share the storage area and specifies the data file and the past images to which access right after the update is the same,

collects, as groups, the data file and the past images that share the storage area and to which the access right after the update is the same, and

concerning the group that shares the storage area with the other groups, allocates a new storage area and copies the data file and the past image included in the group before temporarily suspending the processing for releasing the sharing.

14. The computer according to claim 1, wherein

when the processor receives an access request to the data file or the past image,

the processor

validates, referring to the present access control list and the past access control list, whether a user has access right to the data file and whether the user has access right to the past images corresponding to the data file,

presents the data file to the user if the user can access the data file, and presents, if the user cannot access the data file, the past image at a point when the user has access right among past images corresponding to the data file to the user.

4. A computer comprising:

a storing unit that stores a data file; and

a processor that reads out the data file from the storing unit, wherein the storing unit stores

a past image that is a past version of the data file,

a present access control list in which access right of a user to the data file is described, and

a past access control list in which access right of a user to the past image is described, and

when the processor receives the period set as the target for rewriting the access right of the user to the past image and the contents of the rewriting as a rewriting request for the past access control list, the processor rewrites the contents of the past access control list corresponding to the period according to the rewriting contents, and

when the processor receives an access request to the past image from the user, the processor reads out access right of the user to the past image from the past access control list and validates, according to a description of the past access control list, whether the user has right for accessing the past image.

7. A computer comprising:

a storing unit that stores a data file; and

a processor that reads out the data file from the storing unit, wherein the storing unit stores

a past image that is a past version of the data file,

a present access control list in which access right of a user to the data file is described, and

a past access control list in which access right of a user to the past image is described, and

if the access right described in the present access control list and the access right described in the past access control list coincide with each other, the processor validates accessibility according to coinciding contents of the access right, and

if the access right described in the present access control list and the access right described in the past access control list do not coincide with each other, the processor compares the access rights and determines to which of the access rights priority should be given.

8. The computer according to claim 7, wherein

if the access right described in the present access control list and the access right described in the past access control list do not coincide with each other, the processor gives priority to the access right applied to a narrower range of users among users to whom the access right described in the present access control list is applied and users to whom the access right described in the past access control list is applied.

9. The computer according to claim 7, wherein

if the access right described in the present access control list and the access right described in the past access control list do not coincide with each other,

if the user is a privileged user, the processor permits access to the past image if a description to the effect that access to the past is permitted is present in any one of the present access control list and the past access control list and, if the user is a general user, the processor does not permit access to the past image unless a description to the effect that access to the past image is permitted is present in both the present access control list and the past access control list.

10. The computer according to claim 7, wherein

the storing unit stores a score table in which a present access control list priority degree representing a degree that priority is given to the present access control list and a past access control list priority degree representing a degree that priority is given to the past access control list are described, and

if the access right described in the present access control list and the access right described in the past access control list do not coincide with each other, the processor calculates a priority degree of the present access control list and a priority degree of the past access control list using the score table and validates accessibility to the data file or the past image according to a result of the calculation.

11. The computer according to claim 10, wherein

in the score table, the present access control list priority degree and the past access control list priority degree are described for each combination pattern of the present access control list, attribute information of a user to whom the present access control list is applied, the past access control list, and attribute information of the user at a point when the past access control list is applied, and

if the access right described in the present access control list and the access right described in the past access control list do not coincide with each other, the processor acquires attribute information of the user at a point set as a target of an access request, calculates a priority degree of the present access control list using the attribute information of the user to whom the present access control list is applied and the present access control list and calculates a priority degree of the past access control list using the attribute information of the user at the point when the past access control list is applied and the past access control list, and validates accessibility to the data file or the past image according to a result of the calculation.

12. The computer according to claim 7, wherein

the storing unit stores an access control list updatability table for defining whether it is permitted to update each of the present access control list and the past access control list, and

when the processor receives a request for updating the present access control list or the past access control list, the processor determines possibility of the update according to a description of the access control list updatability table.

13. The computer according to claim 12, wherein

the access control list updatability table defines possibility of update of the past access control list for each period in which access right of the user to the past image is specified on the past access control list, and

when the processor receives a request for updating access right to the past image at a certain point in the past, the processor determines possibility of update at that point according to a description of the access control list updatability table.