Systems and Methods for Facilitating Access to Private Files Using a Cloud Storage System

• US 20160149888A1
• Filed: 01/29/2016
• Published: 05/26/2016
• Est. Priority Date: 10/12/2012
• Status: Active Grant

• Current Assignee: Egnyte Incorporated
• Original Assignee: Egnyte Incorporated
• Inventors: Ancin, Hakan, Chen, Xi, Jassal, Amrit, Jung, Daniel H., Neustaetter, Gregory B., Puttergill, Sean H., Sundararaj, Ramakrishnan, Vedanthan, Sanjay, Yalangi, Chandra, Kavasseri, Ramanathan, Wijayaratne, Ravi, Sharma, Shishir
• Granted Patent: US 10,037,434 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 15/17331 Distributed shared memory [DSM], e.g. remote direct memory access [RDMA]
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/14 Details of searching files based on file metadata
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: G06F 16/1844 Management specifically adapted to replicated file systems
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method for providing access to objects associated with a particular client in a cloud storage system is disclosed. The method includes the steps of establishing a connection with a user, providing a client namespace associated with the client to the user, where the client namespace represents objects stored on the cloud storage system and objects stored on a private storage system apart from the cloud storage system, receiving a request from the user to access an object stored on the private storage system, and providing information to the user to facilitate access to the object stored on the private storage system by said user. Other systems and methods are also disclosed. Important advantages of the present invention are facilitated by separating the logic for user access (control plane) from the actual storage (Storage plane). Private file system access can still be managed from the cloud, while keeping the client data private.

Claims

1. In a cloud storage system, a method for providing access to objects associated with a particular client, said method comprising:

establishing a connection with a user associated with said client over a network;

providing a client namespace associated with said client to said user, said client namespace including information representing objects of a cloud file system stored on said cloud storage system and information being indicative of portions of a private file system stored on a private storage system apart from said cloud storage system;

receiving a request from said user to access a portion of said private file system stored on said private storage system; and

providing access information to said user responsive to said request to access said portion of said private file system, said access information facilitating access by said user to said portion of said private file system via said private file system.

2. The method of claim 1, wherein said access information includes connection information enabling said user to establish a separate connection with said private storage system.

3. The method of claim 2, wherein said connection information includes HTTP(S) endpoint information associated with said private storage system.

4. The method of claim 3, wherein said endpoint information indicates a read-only endpoint.

5. The method of claim 1, wherein said step of providing access information to said user responsive to said request includes redirecting said user to said private storage system.

6. The method of claim 1, further comprising:

establishing a second connection with said private storage system;

requesting access to said portion of said private file system on behalf of said user via said second connection; and

gaining access to said requested portion of said private file system via said second connection; and

wherein

said step of providing access information to said user includes providing a private namespace including information representing private objects of said portion of said private file system to said user via said connection.

7. The method of claim 1, wherein:

said step of providing said client namespace includes providing a client namespace further including information being indicative of portions of a second private file system stored on a second private storage system apart from said cloud storage system; and

said method further comprises the steps of

receiving a second request from said user to access a portion of said second private file system; and

providing second access information to said user responsive to said second request, said second access information facilitating access by said user to said portion of said second private file system via said second private storage system.

8. The method of claim 7, wherein:

said step of providing said client namespace to said user includes providing a first portion of said client namespace to said user based on objects stored on said cloud storage system;

said access information enables said user to retrieve a second portion of said client namespace from said private storage system; and

said second access information enables said user to retrieve a third portion of said client namespace from said second private storage system.

9. The method of claim 8, wherein said step of establishing said connection with said user includes establishing said connection with said user via said private storage system.

10. The method of claim 1, wherein said access information enables said user to retrieve a private portion of said client namespace from said private storage system.

11. A cloud storage system for providing access to objects associated with a particular client, said cloud storage system comprising:

memory for storing data and code;

at least one processing unit for executing said code, said code including a namespace module operative to

provide a client namespace associated with said client, said client namespace including information representing objects of a cloud file system stored on said cloud storage system and information being indicative of portions of a private file system stored on a private storage system apart from said cloud storage system and

provide access information to facilitate access to a portion of said private file system via said private storage system; and

at least one network interface operative to

establish a network connection with a user associated with said client,

provide said client namespace to said user,

receive a request from said user to access said portion of said private storage system, and

provide said access information to said user to facilitate access by said user to said portion of said private file system.

12. The system of claim 11, wherein said access information includes connection information enabling said user to establish a separate connection with said private storage system.

13. The system of claim 12, wherein said connection information includes HTTP(S) endpoint information associated with said private storage system.

14. The system of claim 13, wherein said endpoint information indicates a read-only endpoint.

15. The system of claim 11, wherein said namespace module is further operative to redirect said user to said private storage system in response to said network interface receiving said request from said user to access said portion of said private file system.

16. The system of claim 11, wherein:

said network interface is further operative to establish a second connection with said private storage system; and

said namespace module is further operative to

request access to said portion of said private file system on behalf of said user via said second connection,

gain access to said requested portion of said private file system via said second connection, and

proxy access to said requested portion of said private file system on behalf of said user.

17. The system of claim 11, wherein said namespace module is further operative to:

provide a client namespace further including information being indicative of portions of a second private file system stored on a second private storage system apart from said cloud storage system; and

provide second access information to facilitate access to a portion of said second private file system via said second private storage system.

18. The system of claim 17, wherein:

said namespace module is further operative to provide a first portion of said client namespace to said user based on objects stored on said cloud storage system;

said access information enables said user to retrieve a second portion of said client namespace from said private storage system; and

said second access information enables said user to retrieve a third portion of said client namespace from said second private storage system.

19. The system of claim 18, wherein said network interface is operative to establish said connection with said user via said private storage system.

20. The system of claim 11, wherein said access information enables said user to retrieve a private portion of said client namespace from said private storage system.

21. A cloud storage system for providing access to objects associated with a particular client, said cloud storage system comprising:

memory for storing data and code;

at least one processing unit for executing said code;

means for providing a client namespace including information representing objects of a cloud file system stored on said cloud storage system and information being indicative of portions of a private file system stored on a private storage system apart from said cloud storage system;

means for providing access information to facilitate access to a portion of said private file system via said private storage system; and

at least one network interface operative to

establish a network connection with a user associated with said client,

provide said client namespace to said user,

receive a request from said user to access said portion of said private storage system, and

provide said access information to said user to facilitate access by said user to said portion of said private file system.

22. A non-transitory, electronically-readable storage medium having code embodied therein for causing an electronic device to perform a method for providing access to objects associated with a particular client, said code being operative to cause said electronic device to:

establish a connection with a user associated with said client over a network;

provide a client namespace associated with said client to said user, said client namespace including information representing objects of a cloud file system stored on said cloud storage system and information being indicative of portions of a private file system stored on a private storage system apart from said cloud storage system;

receive a request from said user to access a portion of said private file system stored on said private storage system; and

provide access information to said user responsive to said request to access said portion of said private file system, said access information facilitating access by said user to said portion of said private file system via said private file system.