Channel-specific file system views in a private network using a public-network infrastructure

• US 6,938,169 B1
• Filed: 12/10/1999
• Issued: 08/30/2005
• Est. Priority Date: 12/10/1999
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Schuba, Christoph L., Caronni, Germano, Gupta, Amit, Kumar, Sandeep, Scott, Glenn C., Markson, Tom R.
• Primary Examiner(s): Darrow, Justin T.
• Application Number:
  US09/457,895
• Time in Patent Office: 2,090 Days
• Field of Search: 713/151, 713/152, 713/162, 713/201, 380/33, 370/390, 709/206
• US Class Current: 726/4
• CPC Class Codes: G06F 16/10 File systems; File servers
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Methods and systems consistent with the present invention provide a Supernet, a private network constructed out of components from a public-network infrastructure. The Supernet provides channel-specific file system views such that the file system of the Supernet is partitioned on a per-channel basis so that nodes on one channel see a different view of the network file system than the nodes on a different channel.

Claims

1. A distributed system with a network having devices with nodes communicating over a first channel and nodes communicating over a second channel, one of the devices comprising:

a secondary storage device comprising;

a plurality of file system entities, a first of the file system entities accessible by the nodes communicating over the first channel and a second of the file system entities accessible by the nodes communicating over the second channel;

a memory comprising;

an operating system that restricts access to the first file system entity to the nodes communicating over the first channel and that restricts access to the second file system entity to the nodes communicating over the second channel; and

one of the nodes that communicates over the first channel that sends a request to access the first file system entity to the operating system, wherein the one node comprises a proc structure accessed to determine that the one node communicates over the first channel; and

a processor for running the operating system and for running the one node.

2. The distributed system of claim 1 wherein the network is a private network running over a public network infrastructure.

3. The distributed system of claim 1 wherein the first file system entity is a file, wherein the devices have a plurality of types, wherein the secondary storage device includes a plurality of versions of the file, each version suitable to a type, and wherein when the operating system receives the request from the one node, the operating system returns the version of the file that is suitable for the type of the one device.

4. The distributed system of claim 1 wherein the operating system maintains a mapping between each of the plurality of file system entities and an authorized channel such that nodes communicating over the authorized channel are authorized to access the associated file system entity.

5. The distributed system of claim 4 wherein the operating system includes a function that returns a list of file system entities where the authorized channel is the first channel.

6. The distributed system of claim 1 wherein the operating system includes an open function that receives a request from the one node to open the first file system entity, that verifies that the one node communicates over the one channel, and that opens the first file system entity when the open function verifies that the one node communicates over the first channel.

7. The distributed system of claim 1 wherein the operating system includes an unlink function that receives a request from the one node to unlink the first file system entity, that verifies that the one node communicates over the one channel, and that deletes the one file system entity when the unlink function verifies that the one node communicates over the first channel.

8. A method in a distributed system with a network of nodes communicating over channels, comprising:

receiving a request from one of the nodes to access a file system entity, the file system entity having an associated authorized one of the channels;

determining whether the node communicates over the authorized channel, wherein the node comprises a proc structure accessed to determine that the node communicates over the authorized channel; and

accessing the file system entity when it has been determined that the node communicates over the authorized channel.

9. The method of claim 8, wherein the method further includes the steps of:

inhibiting access to the file system entity when it has been determined that the node does not communicate over the authorized channel.

10. The method of claim 8 wherein the file system entity is a file, wherein the network has a plurality of devices, each with an associated type, wherein the method is performed by one of the devices, and wherein the network stores a plurality of versions of the file, one version for each type and wherein the accessing step further includes the steps of:

identifying the version of the file that is suitable for the type of the one device; and

accessing the identified version.

11. The method of claim 8, wherein the method is performed by an operating system.

12. A distributed system with a network of nodes communicating over channels, comprising:

mean for receiving a request from one of the nodes to access a file system entity, the file system entity having an associated authorized one of the channels;

means for determining whether the node communicates over the authorized channel, wherein the node comprises a proc structure accessed to determine that the node communicates over the authorized channel; and

means for accessing the file system entity when it has been determined that the node communicates over the authorized channel.

13. A method in a distributed system with a network having nodes communicating over channels, the network having a file system with a plurality of file system entities, each with an associated authorized channel, the method comprising:

receiving a request from one of the nodes communicating over one of the channels, the request for viewing the file system;

determining which file system entities in the file system have an authorized channel as the one channel, wherein the one node comprises a proc structure accessed to determine that the one node communicates over the authorized channel; and

returning an indication of the determined file system entities.

14. A computer-readable memory device encoded with a data structure for implementation by an operating system in providing channel-specific views of a file system, the data structure having entries, each entry comprising:

an indication of a file system entity; and

an indication of a channel that is used by the operating system to restrict access to the file system entity to nodes that communicate over the indicated channel, wherein each of the nodes comprises a proc structure that includes the indication of the channel that is used by the operating system to restrict access to the file system entity.

15. The computer-readable memory device of claim 14, wherein the indication of a file system entity is an indication of a version of a file and wherein each entry further includes:

an indication of a device type that is used by the operating system to determine whether a requesting node that requests access to the version of the file runs on a device having the indicated device type.

16. A computer-readable medium containing instructions for controlling a distributed system with a network of nodes communicating over channels to perform a method comprising:

receiving a request from one of the nodes to access a file system entity, the file system entity having an associated authorized one of the channels;

determining whether the node communicates over the authorized channel, wherein the node comprises a proc structure accessed to determine that the node communicates over the authorized channel; and

accessing the file system entity when it has been determined that the node communicates over the authorized channel.

17. The computer-readable medium of claim 16, wherein the method further includes:

inhibiting access to the file system entity when it has been determined that the node does not communicate over the authorized channel.

18. The computer-readable medium of claim 16, wherein the file system entity is a file, wherein the network has a plurality of devices, each with an associated type, wherein the method is performed by one of the devices, and wherein the network stores a plurality of versions of the file, one version for each type and wherein the accessing step further includes:

identifying the version of the file that is suitable for the type of the one device; and

accessing the identified version.

19. The computer-readable medium of claim 16, wherein the method is performed by an operating system.