MULTIPROTOCOL ACCESS CONTROL LIST WITH GUARANTEED PROTOCOL COMPLIANCE

• US 20150135331A1
• Filed: 11/14/2013
• Published: 05/14/2015
• Est. Priority Date: 11/14/2013
• Status: Active Grant

• Current Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Inventors: DAS, Kalyan
• Granted Patent: US 9,336,406 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

An approach to multiprotocol ACL implementation with guaranteed protocol compliance is described. In one approach, a method of access rights validation for a multiprotocol supported file server is detailed. The method involves receiving a request to store a file with a security descriptor and storing the security descriptor in an extended attribute associated with the file. Subsequently, the security descriptor is expanded to extract a set of ACEs. Access to the file can then be validated against the ACEs expanded from the security descriptor according to the specifications of the protocol that created the security descriptor.

Claims

1. A method of access rights validation for a multiprotocol supported file server, comprising:

receiving a request to store a file on a file server from an owner protocol, the request to store comprising a file and a security descriptor;

storing the file on the file server;

storing the security descriptor as a byte sequence according to a specification of the owner protocol in an extended attribute associated with the file;

receiving a request to open the file from a requestor protocol having a user ID;

expanding the security descriptor to extract a set of ACEs (access control entries);

transforming the user ID to a mapped ID according to a specification of the owner protocol; and

validating the mapped ID against the set of ACEs expanded from the security descriptor according to a specification of the owner protocol.

2. The method of claim 1, wherein the request to open the file comprises an access mode.

3. The method of claim 2, further comprising validating the access mode against an open state of the file.

4. The method of claim 3, further comprising:

sending the request to open the file, the security descriptor, and an open state to a multiprotocol access handler;

upon receiving a request to open the file, validating the access mode against the open state at the multiprotocol access handler and validating the user ID against the set of ACEs expanded from the security descriptor at the multiprotocol access handler.

5. The method of claim 1, further comprising:

setting a mode bit associated with the file based on the security descriptor.

6. The method of claim 1, wherein the user ID is transformed using a mapping table.

7. The method of claim 1, wherein the user ID is transformed according to a specification of the owner protocol.

8. The method of claim 1, wherein a user ID will be treated as a member of an unauthenticated user group if no mapped ID is available.

9. The method of claim 1, wherein the extended attribute is contained in an inode associated with the file.

10. The method of claim 9, wherein the file system is POSIX compliant.

11. A computer usable medium having computer-readable program code embodied therein for causing a computer system to execute a method of access rights validation for a multiprotocol supported file server, comprising:

receiving a request to store a file on a file system from an owner protocol, the request to store comprising a file and a security descriptor;

storing the file on the file system;

storing the security descriptor as a byte sequence according to a specification of the owner protocol in an extended attribute associated with the file;

receiving a request to open the file from a requestor protocol having a user ID;

expanding the security descriptor to extract a set of ACEs (access control entries);

transforming the user ID to a mapped ID according to a specification of the owner protocol; and

validating the mapped ID against the set of ACEs expanded from the security descriptor according to a specification of the owner protocol.

12. The computer usable medium of claim 11, wherein the request to open the file further comprises an access mode.

13. The computer usable medium of claim 12, further comprising validating the access mode against an open state of the file.

14. The computer usable medium of claim 13, further comprising:

sending the request to open the file, the security descriptor, and an open state to a multiprotocol access handler; and

upon receiving a request to open the file, validating the access mode against the open state at the multiprotocol access handler and validating the user ID against the set of ACEs expanded from the security descriptor at the multiprotocol access handler.

15. The computer usable medium of claim 11, further comprising:

setting a mode bit associated with the file based on the security descriptor.

16. The computer usable medium of claim 11, wherein the user ID is transformed using a mapping table.

17. An apparatus for providing access rights validation for a multiprotocol supported file server, comprising:

a multiprotocol access handler circuit configured to receive a request to store a file on a file system from an owner protocol, the request to store comprising a file and a security descriptor; and

memory coupled to the multiprotocol access handler circuit storing a file system configured to;

store the file on the file server;

store the security descriptor as a byte sequence according to a specification of the owner protocol in an extended attribute associated with the file; and

expand the security descriptor to extract a set of ACEs (access control entries) in response to receiving a request to open the file from a requestor protocol having a user ID;

wherein the user ID is transformed to a mapped ID according to a specification of the owner protocol, and the mapped ID is validated against the set of ACEs expanded from the security descriptor by the multiprotocol access handler circuit according to a specification of the owner protocol.

18. The apparatus of claim 17, wherein the request to open further comprises an access mode and the access mode is validated by the multiprotocol access handler circuit against an open state of the file.

19. The apparatus of claim 17, wherein a mode bit associated with the file is set based on the security descriptor.

20. The apparatus of claim 17, further comprising a mapping table configured to map a user ID to a mapped ID according to a specification of the owner protocol.