Access check system utilizing cached access permissions

• US 5,889,952 A
• Filed: 08/14/1996
• Issued: 03/30/1999
• Est. Priority Date: 08/14/1996
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hunnicutt, Heath, Ludeman, John F.
• Primary Examiner(s): Ramirez, Ellis B.
• Application Number:
  US08/689,838
• Time in Patent Office: 958 Days
• Field of Search: 395/200.49, 395/200.55, 395/200.57, 395/200.59, 395/186, 395/187.01
• US Class Current: 709/219
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

An access-check system for a network server comprises an access-cache for storing access-permissions generated by the server in response to resource access requests. The system retrieves the appropriate access-permission from the access-cache in response to receipt of a request necessitating the same access-permission as already generated for an earlier processed request. A user-token cache is also employed to assign a unique user-token, to be used in the access-cache, to each user logged on to the server. Changes made to the user-token cache are reflected in the access-cache by removing from the access-cache those entries containing the changed user-token. Changes made to an access control list are reflected in the access-cache by removing from the access-cache those entries containing the server resource with which the changed access control list is associated.

Claims

1. A machine-readable program storage device, embodying instructions executable by a computer to perform method steps for providing access to a plurality of resources in a file system to a plurality of users, where access to said resources is controlled by said network server and each of said plurality of users send requests to a network server for permission to access at least one of said plurality of resources, said method comprising:

first step of receiving a first resource request by said network server from a requesting user that is among said plurality of users, wherein said requesting user requests access to a requested resource from among said plurality of resources absent any authentication-processing of said resource request by said requesting user;

determining by said network server that said requesting user has permission to access said requested resource based only on a user-name of said requesting user;

generating an access-permission for said requesting user in response to successfully determining that said requesting user has permission to access said requested resource;

storing said access-permission in an access-cache accessible to said network server, wherein said access-cache contains n>

2 of the last access-permissions generated and absent any access-permission information stored by said requesting user;

first step of providing access to said requested resource by said requesting user in response to successfully determining that said requesting user has permission to access said requested resource;

second step of receiving a second resource request by said network server from said requesting user to access said requested resource, wherein said second resource request contains identical user identifying information as said first resource request;

retrieving said access-permission stored in said access-cache by said network server, wherein said access-permission corresponds only to said user-name of said requesting user and said step of retrieving occurs only in response to receipt of said second resource request alone absent any other identifier of said requesting user beyond said user-name, and wherein said second resource request necessitates the same access-permission as said access-permission stored in said access-cache; and

second step of providing access to said requested resource by said requesting user in response to said retrieving step.

2. A method according to claim 1 wherein said determining step includes:

opening an access control list wherein said access control list includes a plurality of entries each of which defines the extent to which corresponding ones of said plurality of users have permission to access said requested resource;

searching said access control list for an entry including said user-name of said requesting user;

reading from said entry the level of access granted to said requesting user with respect to said requested resource; and

indicating to said network server, in response to said reading step, that said requesting user has permission to access said requested resource.

3. A method according to claim 2 wherein said opening step includes:

locating said requested resource where said requested resource contains said access control list;

opening said requested resource;

searching said access control list for one of said plurality of entries that includes said name of said requesting user;

reading from said entry the level of access granted to said requesting user with respect to said requested resource; and

indicating to said network server, in response to said reading step, that said requesting user has permission to access said requested resource.

4. A method according to claim 3 wherein said step of opening said requested resource comprises:

opening a disk wherein said requested resource is said disk.

5. A method according to claim 3 wherein said step of opening said requested resource comprises:

opening a file wherein said requested resource is said file.

6. A method according to claim 1 wherein said step of receiving a first resource request includes:

identifying said name of said requesting user sending said first resource request;

selecting a user-token from a user token-cache wherein said user-token is associated with said user-name of said requesting user; and

utilizing said user-token with respect to processing said first resource request from said requesting user.

7. A method according to claim 6 wherein said determining step includes:

opening an access control list wherein said access control list includes multiple entries each one of which defines the extent to which different ones of said plurality of users have permission to access said requested resource;

searching said access control list for an entry including said user-token;

reading from said entry the level of access granted to said user-token with respect to said requested resource; and

indicating to said network server, in response to said reading step, that said requesting user having said user-token has permission to access said requested resource.

8. A method according to claim 7 wherein said opening step includes:

locating said requested resource where said requested resource contains said access control list;

opening said requested resource;

searching said access control list for an entry including said user-token;

reading from said entry the level of access granted to said user-token with respect to said requested resource; and

indicating to said network server, in response to said reading step, that said requesting user having said user-token has permission to access said requested resource.

9. A method according to claim 2 wherein said step of generating said access-permission includes:

combining said name of said requested resource and said user-name of said requesting user to form said access-permission in response to said step of indicating that said requesting user has permission to access said requested resource.

10. A method according to claim 2 wherein said requested resource is a file having a file name, said step of generating said access-permission includes:

combining said file name and said user-name of said requesting user to form said access-permission in response to said step of indicating that said requesting user has permission to access said requested resource.

11. A method according to claim 7 wherein said step of generating said access-permission includes:

combining said name of said requested resource and said user-token to form said access-permission in response to said step of indicating that said requesting user having said user-token has permission to access said requested resource.

12. A method according to claim 7 wherein said requested resource is a file having a file name, said step of generating said access-permission includes:

combining said file name and said user-token to form said access-permission in response to said step of indicating that said requesting user has permission to access said requested resource.

13. A method according to claim 1 wherein said generating step includes:

combining a first set of data identifying said requesting user with a second set of data identifying a location of said requested resource to form said access-permission.

14. A method according to claim 1 wherein said retrieving step includes:

determining said user-name of said second one of said plurality of users;

determining a resource-name of said requested resource; and

selecting from said access cache a one of said n access-permissions wherein said selected access-permission contains said user-name and said resource name.

15. A method according to claim 14 wherein said step of determining said user-name includes:

searching a user-token cache for a user-token associated with said requesting user; and

selecting said user-token in response to said searching step.

16. A method according to claim 15 wherein said step of selecting one of said n access-permissions from said access-cache includes:

selecting from said access cache a one of said n access-permissions wherein said selected access-permission contains said user-name and said resource name.

17. A method according to claim 1 wherein said first step of retrieving step includes:

searching a user-token cache for a user-token associated with a first requesting user; and

selecting said user-token in response to said searching step,

identifying a file-name wherein said file-name identifies said requested resource; and

selecting from said access cache a one of said n access-permissions wherein said selected access-permission contains said user-token and said resource name.

18. A method according to claim 1 further comprising the steps of:

tracking security changes made to said network server; and

updating, in response to said tracking step, said access-cache to ensure the security of said plurality of resources stored on said network server.

19. A method according to claim 18 wherein said tracking step includes:

tracking changes made to a user-token cache wherein said user-token cache contains a unique user-token for each of said plurality of users that has logged on to said network server.

20. A method according to claim 19 wherein said updating step includes:

removing from said access-cache all said access-permissions containing said user-token that has been changed.

21. A method according to claim 18 wherein said tracking step includes:

tracking changes made to said plurality of resources in said file system by storing a resource name of one of said plurality of resources that has been changed.

22. A method according to claim 21 wherein said updating step includes:

removing from said access-cache all said access-permissions containing a name of one of said plurality of resources that has changed.

23. A method operational in a network server for providing access to at least one of a plurality of resources in a file system where access to said at least one of said plurality of resources is controlled by said network server and each of a plurality of users send requests to said network server for permission to access said resources, said method comprising:

first step of receiving a first resource request by said network server from a requesting user that is among said plurality of users, wherein said requesting user requests access to a requested one of said plurality of resources;

determining, based only on a publicly known user-name of said requesting user in response to said first resource request, that said requesting user has permission to access said requested one of said plurality of resources;

generating, in response to successfully determining that said requesting user has permission to access said requested resource, an access-permission;

storing said access-permission in an access-cache accessible to said network server wherein said access cache contains the last n access-permissions generated, where n is a positive integer greater than 2;

first step of providing access to said requested resource by said requesting user in response to successfully determining that said requesting user has permission to access said requested resource;

second step of receiving a second resource request from said requesting user to access said requested resource;

retrieving one of said last n access-permissions stored in said access-cache by said network server based only on said publicly known user-name of said requesting user, in response to receipt of said second resource request wherein said second resource request by said requesting user necessitates the same access-permission as said access-permission stored in said access-cache; and

second step of providing access to said requested resource for said requesting user in response to said retrieving step.

24. An apparatus operational in a network server for providing access to at least one of a plurality of resources in a file system where access to said at least one of a plurality of resources is controlled by said network server and each of a plurality of users send requests to said network server for permission to access said at least one of a plurality of resources, said apparatus comprising:

first means for receiving a first resource request by said network server from a requesting user that is among said plurality of users, wherein said requesting user requests access to a requested resource from among said plurality of resources absent any authentication-processing of said resource request by said requesting user;

means for determining by said network server that said requesting user has permission to access said requested resource based only on a publicly known user-name of said requesting user;

means for generating an access-permission for said requesting user in response to successfully determining that said requesting user has permission to access said requested resource;

means for storing said access-permission in an access-cache accessible only to said network server, wherein said access cache contains n>

2 of the last access-permissions generated;

first means for providing access to said requested resource by said requesting user in response to successfully determining that said requesting user has permission to access said requested resource;

second means for receiving a second resource request from said requesting user to access said requested resource, wherein said second resource request contains identical user identifying information as said first resource request;

means for retrieving said access-permission stored in said access-ache by said network server, wherein said access-permission corresponds only to said user-name of said requesting user and said means for retrieving occurs only in response to receipt of said second resource request alone absent any other identifier of said requesting user beyond said user-name, and wherein said second resource request necessitates the same access-permission as said access-permission stored in said access-cache; and

second means for providing access to said requested resource by said requesting user in response to said retrieving step.