Permissions of objects in hosted storage

• US 8,375,185 B1
• Filed: 04/20/2012
• Issued: 02/12/2013
• Est. Priority Date: 09/26/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Hanson, David R., Aikas, Erkki Ville Juhani
• Primary Examiner(s): YU, JAE UN
• Application Number:
  US13/451,939
• Time in Patent Office: 298 Days
• Field of Search: 711/152, 711/163, 711/164, 711/202, 710/200, 380/264
• US Class Current: 711/163
• CPC Class Codes: G06F 12/14 Protection against unauthorised use of memory or access to memory
• CPC Class Codes: G06F 12/1416 by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights G06F12/1458 takes precedence
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A data object is stored in a hosted storage system and includes an access control list specifying access permissions for data object stored in the hosted storage system. The hosted storage system provides hosted storage to a plurality of clients that are coupled to the hosted storage system. A request to store a second data object is received. The request includes an indicator that the first data object stored in the hosted storage system should be used as an access control list for the second data object. The second data object is stored in the hosted storage system. The first data object is assigned as an access control list for the second data object stored in the hosted storage system.

Claims

1. A method performed by one or more processors, the method comprising:

sending, by a client system to a hosted storage system, a first data object such that the hosted storage system stores the first data object, the first data object comprising an access control list specifying access permissions for data objects stored in the hosted storage system, wherein the hosted storage system provides hosted storage to a plurality of clients that are coupled to the hosted storage system;

sending, by the client system to the hosted storage system, a request to store a second data object such, the request including an indicator that the first data object stored in the hosted storage system should be used as an access control list for the second data object, wherein the hosted storage system is configured to, in response to receiving the request to store the second data object, store the second data object and assign the first data object as an access control list for the second data object stored in the hosted storage system.

2. The method of claim 1, wherein to assign the first data object as an access control list, the hosted storage system is configured to copy the first data object and use the copied data object as the access control list.

3. The method of claim 1, wherein to assign the first data object as an access control list, the hosted storage system is configured to store a reference to the first data object, in association with the second data object, as the access control list.

4. The method of claim 3, the method further comprising:

sending, by the client to the hosted storage system, a request from a user to access the second data object, wherein the hosted storage system is configured to, in response to receiving the request to access the second object, access the first data object using the stored reference and determine that the user is permitted to access the second data object; and

receiving, by the client from the hosted storage system, access to the object.

5. The method of claim 1, wherein the request to store a second data object is a Representational State Transfer (REST) formatted message.

6. The method of claim 1, wherein the access control list of the first data object comprises XML formatted text.

7. The method of claim 1, wherein:

the hosted storage system indexes the data objects stored in the hosted storage system in buckets and;

the access control list of the first data object specifies access permissions for one or more of the buckets.

8. A computer storage medium storing a computer program, the program comprising instructions that, when executed by one or more processing devices, cause the one or more processing devices to perform operations comprising:

sending, by a client system to a hosted storage system, a first data object such that the hosted storage system stores the first data object, the first data object comprising an access control list specifying access permissions for data objects stored in the hosted storage system, wherein the hosted storage system provides hosted storage to a plurality of clients that are coupled to the hosted storage system;

sending, by the client system to the hosted storage system, a request to store a second data object such, the request including an indicator that the first data object stored in the hosted storage system should be used as an access control list for the second data object, wherein the hosted storage system is configured to, in response to receiving the request to store the second data object, store the second data object and assign the first data object as an access control list for the second data object stored in the hosted storage system.

9. The computer storage medium of claim 8, wherein to assign the first data object as an access control list, the hosted storage system is configured to copy the first data object and use the copied data object as the access control list.

10. The computer storage medium of claim 8, wherein to assign the first data object as an access control list, the hosted storage system is configured to store a reference to the first data object, in association with the second data object, as the access control list.

11. The computer storage medium of claim 10, the operations further comprising:

sending, by the client to the hosted storage system, a request from a user to access the second data object wherein the hosted storage system is configured to, in response to receiving the request to access the second object, access the first data object using the stored reference and determine that the user is permitted to access the second data object; and

receiving, by the client from the hosted storage system, access to the object.

12. The computer storage medium of claim 8, wherein the request to store a second data object is a Representational State Transfer (REST) formatted message.

13. The computer storage medium of claim 8, wherein the access control list of the first data object comprises XML formatted text.

14. The computer storage medium of claim 8, wherein:

the hosted storage system indexes the data objects stored in the hosted storage system in buckets and;

the access control list of the first data object specifies access permissions for one or more of the buckets.