File storage apparatus and access control method

• US 8,438,185 B2
• Filed: 11/17/2010
• Issued: 05/07/2013
• Est. Priority Date: 11/17/2010
• Status: Expired due to Fees

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Teranishi, Mika, Shibuya, Hiroji, Murayama, Shunji, Kimura, Toshio
• Primary Examiner(s): Le, Debbie
• Assistant Examiner(s): BOWEN, RICHARD L
• Application Number:
  US12/996,145
• Publication Number:
  US 20120124092A1
• Time in Patent Office: 902 Days
• Field of Search: 707/783
• US Class Current: 707/783
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2147 Locking files

Abstract

Proposed are a file storage apparatus and an access control method capable of facilitating the setting and change of an access right of a user for accessing a file.

A first account which only authorizes referral of all files and a second account which authorizes referral and editing of all files are defined in advance as accounts in a file system, and if a workspace unit receives an access request from a client for accessing a file and the access right in the workspace of the user for accessing the target file of the access request and the access right in the file system are different, the workspace unit requests the file system unit to perform the access processing to the file upon switching the account of the user to the first or second account.

Claims

1. A file storage apparatus, which provides a file system to a client and provides a workspace to a user and comprises at least one computer:

a storage medium configured to store a file;

a memory configured to store;

file management information, which includes a first access right of the user to the file on the file system;

workspace access right information, which includes a second access right of the user to the workspace;

workspace file utilization information, which includes a utilization condition of the file on the workspace;

account management information, which includes a first account authorized to read the file and a second account authorized to read and edit the file; and

workspace file management information, which includes a third access right of the user to the file on the workspace; and

a controller, which is configured to;

manage, using the at least one computer, the first access right of the user to the file on the file system;

process, using the at least one computer, a first access to the file on the file system based on the first access right of the user by referring to the file management information;

create, using the at least one computer, the third access right of the workspace file management information based on the first access right of the file management information, the second access right of the workspace access right information and the utilization condition of the file on the workspace file utilization information;

when the user accesses the file via the workspace,

process, using the at least one computer, a second access to the workspace based on the second access right of the workspace access right information;

identify, using the at least one computer, the third access right of the user to the file on the workspace based on the workspace file management information;

switch, using the at least one computer, the second access right of the user to the identified third access right; and

process, using the at least one computer, an access to the file on the workspace by the identified third access right.

2. The file storage apparatus according to claim 1, wherein the controller is further configured to:

segmentalize, using the at least one computer, the file into a plurality of structuring units;

update, using the at least one computer, the file for each of the structuring units,

form, using the at least one computer, a temporary copy of the file that is a target of an update request if another user is updating the file,

update, using the at least one computer, the temporary copy according to the update request, detect the structuring unit that was updated after the update of the temporary copy is completed, and

update, using the at least one computer, the structuring units of the file that were updated for each of the structuring units.

3. The file storage apparatus according to claim 1, wherein the controller is further configured to:

segmentalize, using the at least one computer, a file into a plurality of structuring units;

update, using the at least one computer, the file for each of the structuring units; and

update, using the at least one computer, only the structuring units of the file that were updated according to an update request of the file if another user is updating the file.

4. The file storage apparatus according to claim 3, wherein the controller is further configured to:

form, using the at least one computer, a temporary copy of the file that is a target of an update request if another user is updating the file,

update, using the at least one computer, the temporary copy according to the update request,

detect, using the at least one computer, the structuring unit that was updated after the update of the temporary copy is completed, and

update, using the at least one computer, each of the structuring units that were updated.

5. An access control method in a file storage apparatus, which provides a file system to a client and provides a workspace to a user, wherein the file storage apparatus comprises at least one computer comprising:

a storage medium configured to store a file;

a memory configured to store;

file management information, which includes a first access right of the user to the file on the file system;

workspace access right information, which includes a second access right of the user to the workspace;

workspace file utilization information, which includes a utilization condition of the file on the workspace;

account management information, which includes a first account authorized to read the file and a second account authorized to read and edit the file; and

workspace file management information, which includes a a third access right to the file on the workspace to the user; and

a controller;

wherein the access control method comprises steps of;

managing, using the at least one computer, the first access right of the user to the file on the file system;

processing, using the at least one computer, a first access to the file on the file system based on the first access right of the user by referring to the file management information;

creating, using the at least one computer, the third access right of the workspace file management information based on the first access right of the file management information, the second access right of the workspace access right information and the workspace file utilization information;

when the user accesses the file via the workspace,

processing, using the at least one computer, a second access to the workspace based on the second access right of the workspace access right information;

identifying, using the at least one computer, the third access right of the user to the file on the workspace based on the workspace file management information;

switching, using the at least one computer, the second access right of the user to the identified third access right; and

processing, using the at least one computer, an access to the file on the workspace by the identified third access right.

6. The access control method according to claim 5, further comprising steps of:

segmentalizing, using the at least one computer, the file into a plurality of structuring units;

updating, using the at least one computer, the file for each of the structuring units,

forming, using the at least one computer, a temporary copy of the file that is a target of an update request if another user is updating the file,

updating, using the at least one computer, the temporary copy according to the update request,

detecting, using the at least one computer, the structuring unit that was updated after the update of the temporary copy is completed, and

updating, using the at least one computer, the structuring units of the file that were updated for each of the structuring units.

7. The access control method according to claim 5, further comprising a step of:

updating, using the at least one computer, only the structuring units of the file that were updated that was segmentalized into a plurality of structuring units according to an update request of the file if another user is updating the file.

8. The access control method according to claim 7, further comprising steps of:

forming, using the at least one computer, a temporary copy of the file that is a target of an update request if another user is updating the file,

updating, using the at least one computer, the temporary copy according to the update request,

detecting, using the at least one computer, the structuring unit that was updated after the update of the temporary copy is complete, and

updating, using the at least one computer, each of the structuring units that were updated.