Permissions of objects in hosted storage

• US 8,924,674 B2
• Filed: 11/04/2013
• Issued: 12/30/2014
• Est. Priority Date: 09/26/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Hanson, David R., Aikas, Erkki Ville Juhani
• Primary Examiner(s): YU, JAE UN
• Application Number:
  US14/071,074
• Publication Number:
  US 20140129792A1
• Time in Patent Office: 421 Days
• Field of Search: 711/163, 711/164, 710/200, 380/264
• US Class Current: 711/163
• CPC Class Codes: G06F 12/14 Protection against unauthorised use of memory or access to memory
• CPC Class Codes: G06F 12/1416 by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights G06F12/1458 takes precedence
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A data object is stored in a hosted storage system and includes an access control list specifying access permissions for data object stored in the hosted storage system. The hosted storage system provides hosted storage to a plurality of clients that are coupled to the hosted storage system. A request to store a second data object is received. The request includes an indicator that the first data object stored in the hosted storage system should be used as an access control list for the second data object. The second data object is stored in the hosted storage system. The first data object is assigned as an access control list for the second data object stored in the hosted storage system.

Claims

1. A method performed by one or more processors, the method comprising:

storing, in a hosted storage system, a first data object comprising an access control list specifying access permissions for data objects stored in the hosted storage system, the hosted storage system providing hosted storage to a plurality of clients that are coupled to the hosted storage system;

receiving, in the hosted storage system, a request to store a second data object;

storing, in the hosted storage system, the second data object;

receiving, in the hosted storage system after storing the second data object, a parameter;

determining that a property of the first data object meets the parameter; and

assigning, in the hosted storage system and responsive to determining that a property of the first data object meets the parameter, the first data object as an access control list for the second data object stored in the hosted storage system.

2. The method of claim 1, wherein storing the second data object includes assigning a default access control list to the second data object;

and

wherein assigning the first data object as an access control list for the second data object includes unassigning the default access control list from the second data object.

3. The method of claim 2, wherein storing the second data object with a default access control list comprises:

storing the second data object in a bucket of the hosted storage system;

selecting, based on the bucket, the default access control list from a plurality of access control lists; and

assigning, after the selecting, the default access control list to the second data object.

4. The method of claim 1, the method further comprising:

receiving, in the hosted storage system, a request to access the second data object from a user;

accessing, in the hosted storage system, the first data object;

determining, based on the first data object, that the user is permitted to access the second data object; and

providing, to the user, access to the object.

5. The method of claim 1, wherein the parameter comprises a data object name, and the property is a name of the first data object.

6. The method of claim 1, wherein the parameter comprises a bucket name and a data object name, and the property is a bucket name and a name of the first object.

7. The method of claim 1, wherein the parameter comprises a universal resource locator, and the property is a universal resource locator of the first object.

8. The method of claim 1, wherein the request to store the second data object includes the parameter.

9. A computer storage medium storing a computer program, the program comprising instructions that, when executed by one or more processing devices, cause the one or more processing devices to perform operations comprising:

storing, in a hosted storage system, a first data object comprising an access control list specifying access permissions for data objects stored in the hosted storage system, the hosted storage system providing hosted storage to a plurality of clients that are coupled to the hosted storage system;

receiving, in the hosted storage system, a request to store a second data object;

storing, in the hosted storage system, the second data object;

receiving, in the hosted storage system after storing the second data object, a parameter;

determining that a property of the first data object meets the parameter; and

assigning, in the hosted storage system and responsive to determining that a property of the first data object meets the parameter, the first data object as an access control list for the second data object stored in the hosted storage system.

10. The computer storage medium of claim 9, wherein storing the second data object includes assigning a default access control list to the second data object;

and

wherein assigning the first data object as an access control list for the second data object includes unassigning the default access control list from the second data object.

11. The computer storage medium of claim 10, wherein storing the second data object with a default access control list comprises:

storing the second data object in a bucket of the hosted storage system;

selecting, based on the bucket, the default access control list from a plurality of access control lists; and

assigning, after the selecting, the default access control list to the second data object.

12. The computer storage medium of claim 9, the operations further comprising:

receiving, in the hosted storage system, a request to access the second data object from a user;

accessing, in the hosted storage system, the first data object;

determining, based on the first data object, that the user is permitted to access the second data object; and

providing, to the user, access to the object.

13. The computer storage medium of claim 9, wherein the parameter comprises a data object name, and the property is a name of the first data object.

14. The computer storage medium of claim 9, wherein the parameter comprises a universal resource locator, and the property is a universal resource locator of the first object.

15. The computer storage medium of claim 9, wherein the request to store the second data object includes the parameter.

16. A computer system comprising:

a hosted storage system configured to;

store a first data object comprising an access control list specifying access permissions for data objects stored in the hosted storage system, the hosted storage system providing hosted storage to a plurality of clients that are coupled to the hosted storage system;

receive a request to store a second data object;

store the second data object;

receive, after storing the second data object, a parameter;

determining that a property of the first data object meets the parameter; and

assign responsive to determining that a property of the first data object meets the parameter the first data object as an access control list for the second data object stored in the hosted storage system; and

a client system configured to;

send, to the hosted storage system, the request to store the second data object.

17. The system of claim 16, wherein to store the second data object, the hosted storage system is configured to assign a default access control list to the second data object;

and

wherein to assign the first data object as an access control list for the second data object, the hosted storage system is configured to unassign the default access control list from the second data object.

18. The system of claim 17, wherein to store the second data object with a default access control list, the hosted storage system is configured to:

store the second data object in a bucket of the hosted storage system;

select, based on the bucket, the default access control list from a plurality of access control lists; and

assign, after the selecting, the default access control list to the second data object.

19. The system of claim 17, wherein:

the hosted storage system is further configured to;

receive a request to access the second data object from the client system;

access the first data object;

determine, based on the first data object, that the user is permitted to access the second data object; and

provide, to the client system, access to the object; and

the client system is further configured to;

send the request to access the second data object to the hosted storage system; and

receive access to the object.

20. The system of claim 16, wherein the parameter comprises a data object name, and the property is a name of the first data object.

21. The system of claim 16, wherein the parameter comprises a bucket name and a data object name, and the property is a bucket name and a name of the first object.

22. The system of claim 16, wherein the parameter comprises a universal resource locator, and the property is a universal resource locator of the first object.

23. The system of claim 16, wherein the request to store the second data object includes the parameter.