FLEXIBLE PERMISSION MANAGEMENT FRAMEWORK FOR CLOUD ATTACHED FILE SYSTEMS

• US 20140149461A1
• Filed: 11/29/2012
• Published: 05/29/2014
• Est. Priority Date: 11/29/2011
• Status: Active Grant

• Current Assignee: Egnyte Incorporated
• Original Assignee: Aahz Aahz
• Inventors: Wijayaratne, Ravi, White, Ray, Marathe, Manish, Aahz, Ram, Rajesh, Jassal, Amrit
• Granted Patent: US 9,483,491 B2
• Time in Patent Office: Days
• US Class Current: 707/785
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 16/188 Virtual file systems
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 12/08 Access security

Abstract

A method of managing file permissions in a remote file storage system includes defining permissions for the remote file storage system and controlling access to objects on the remote file storage system according to the permissions of the remote file storage system. The permissions are transferred to a client file storage system remote from the remote file storage system, and access to objects on the client file storage system is controlled according to the permissions of the remote file storage system. A remote file storage system includes a permissions file generator operative to generate a permissions file, which is transmitted to a client file storage system for enforcement at the client file storage system.

Claims

1. A method of managing file permissions in a remote file storage system, said method comprising:

defining permissions for said remote file storage system;

controlling access to objects on said remote file storage system according to said permissions of said remote file storage system;

transferring said permissions to a client file storage system remote from said remote file storage system; and

controlling access to objects on said client file storage system according to said permissions of said remote file storage system.

2. The method of claim 1, additionally comprising:

defining a virtual file system structure for said objects on said remote file storage system; and

defining said permissions framework based at least in part on said virtual file system structure.

3. The method of claim 1, wherein said step of controlling access to objects on said client file storage system according to said permissions of said remote file storage system includes overriding permissions of said client file storage system.

4. The method of claim 1, additionally comprising:

altering said permissions of said remote file storage system at said remote file storage system;

controlling access to objects on said remote file storage system according to said altered permissions of said remote file storage system;

transferring said altered permissions to said client file storage system; and

controlling access to objects on said client file storage system according to said altered permissions of said remote file storage system.

5. The method of claim 4, wherein said step of transferring said altered permissions to said client file storage system occurs in conjunction with a data synchronization process between said remote file storage system and said client file storage system.

6. The method of claim 4, wherein said step of transferring said altered permissions to said client file storage system occurs in response to a command from a user.

7. The method of claim 4, wherein said step of transferring said altered permissions to said client file storage system occurs in response to said step of altering said permissions.

8. The method of claim 1, additionally comprising:

altering said permissions of said remote file storage system at said client file storage system;

controlling access to objects on said client file storage system according to said altered permissions of said remote file storage system.

transferring said altered permissions to said remote file storage system; and

controlling access to objects on said remote file storage system according to said altered permissions of said remote file storage system.

9. The method of claim 8, wherein said step of transferring said altered permissions to said remote file storage system occurs in conjunction with a data synchronization process between said remote file storage system and said client file storage system.

10. The method of claim 8, wherein said step of transferring said altered permissions to said remote file storage system occurs in response to a command from a user.

11. The method of claim 8, wherein said step of transferring said altered permissions to said remote file storage system occurs in response to said step of altering said permissions.

12. The method of claim 1, wherein said step of defining permissions for said remote file storage system includes associating access control lists with said objects on said remote file storage system.

13. The method of claim 1, additionally comprising:

defining a plurality of permissions sets for said remote file storage system;

associating each of said permissions sets with a respective one of a plurality of clients;

controlling access to objects on said remote file storage system by said clients according to said permissions sets of said remote file storage system;

transferring each of said permissions sets to a respective one of a plurality of client file storage systems each associated with one of said plurality of clients, said client file storage systems being remote from said remote file storage system; and

controlling access to objects on said client file storage systems according to said permission sets of said remote file storage system associated with said clients.

14. A remote file storage system comprising:

memory for storing file objects received from a client;

a client interface operative to receive said file objects from a client, to provide said file objects to said client, to receive data indicative of permissions associated with said file objects, and to provide a permissions file to said client;

a permissions file generator operative to generate a permissions file based on said data indicative of said permissions associated with said file objects; and

a permissions enforcer operative to control access to said file objects according to said permissions file.

15. The system of claim 14, additionally comprising:

a processing unit; and

wherein

said permissions file generator and said permissions enforcer are code modules executed by said processing unit.

16. The system of claim 14, additionally comprising:

a virtual file system module operative to define a virtual file system structure for said file objects; and

wherein

said permissions file generator is operative to generate said permissions file based at least in part on said virtual file system structure.

17. The system of claim 14, wherein:

said client interface is operative to receive additional data indicative of permissions associated with said file objects;

said permissions file generator is operative to generate an updated permissions file based at least in part on said additional data indicative of permissions associated with said file objects; and

said client interface is operative to provide said updated permissions file to said client.

18. The system of claim 17, additionally comprising a synchronizer operative to:

synchronize said file objects stored on said remote file storage system with file objects stored on a file storage system of said client; and

synchronize said permissions file with a permissions file on said file storage system of said client.

19. The system of claim 14, wherein said permissions file associates access control lists with said file objects.

20. A local file storage system for use with a remote file storage system, said local file storage system including:

memory for storing file objects from local clients;

a client interface operative to receive said file objects from local clients and to provide said file objects to said clients;

a remote file server interface operative to receive a permissions file indicative of permissions associated with said file objects from a remote file server; and

a permissions enforcer operative to control access to said file objects by said local clients according to said permissions file.

21. The system of claim 20, additionally comprising:

a virtual file system module operative to present a virtual file system structure associated with said file objects to said local clients; and

wherein

said permissions file is based at least in part on said virtual file system structure.

22. The system of claim 21, wherein said permissions file associates access control lists with elements of said virtual file structure.

23. A file storage system comprising:

a local file storage system for storing and providing file objects to local clients;

a remote file storage system for storing and providing copies of said file objects;

a permissions file generator on at least one of said local file storage system and said remote file storage system and operative to generate a permissions file and to provide said permissions file to said local file storage system and said remote file storage system;

a first permissions enforcer on said local file storage system, said first permissions enforcer operative to control access to said file objects on said local file storage system according to said permissions file; and

a second permissions enforcer on said remote file storage system, said second permissions enforcer operative to control access to said file objects on said remote file storage system according to said permissions file.

24. The system of claim 23, additionally comprising:

a file object synchronizer operative to synchronize said file objects stored on said remote server and said file objects stored on said local server; and

a permissions file synchronizer operative to synchronize said permissions file on said remote server and said permissions file on said local server.