Authenticated file handles for network file systems

• US 8,924,725 B2
• Filed: 01/27/2014
• Issued: 12/30/2014
• Est. Priority Date: 08/07/2012
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Russell, Paul F., Sahlberg, Leif R.
• Primary Examiner(s): Gelagay, Shewaye
• Application Number:
  US14/164,420
• Publication Number:
  US 20140143535A1
• Time in Patent Office: 337 Days
• Field of Search: None
• US Class Current: 713/168
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

One or more file sharing computers receives a client request including an IP address and port number used by the client (computer). The one or more computers respond by creating an enhanced file handle from a hash on a combination of the IP address, port number, restricted key, and a standard file handle, and concatenating the hash with the standard file handle. The enhanced file handle is sent to the client and used by the client in a second request. The one or more computers uncouple the standard file handle and hash combination. Using the client IP address, port number, restricted key and standard file handle from the client second request, the one or more computers create a second combination. The second combination hash is compared to the first combination hash and in response to determining a match, the second request is accepted, and otherwise denied.

Claims

1. A method for enhancing a file handle within a distributed file sharing system including one or more file sharing computers connected to a network, the method comprising:

receiving a first client request, wherein the first client request includes information about a client computer;

in response to receiving the first client request, creating a standard file handle;

generating a first combination that includes information about the client computer received from the first client request, the standard file handle and a key that includes a random value, wherein the random value of the key is restricted to the one or more file sharing computers;

encrypting the first combination and appending the encrypted first combination to the standard file handle, creating an enhanced file handle;

sending the enhanced file handle to the client computer;

receiving a second client request, wherein the second client request includes information about the client computer and the enhanced file handle;

in response to receiving the second client request, the one or more file sharing computers uncoupling the file handle and the encrypted first combination from the enhanced file handle;

generating a second combination from information about the client computer received in the second client request, the standard file handle uncoupled from the enhanced file handle of the second client request and the key that includes the random value that is restricted to the one or more file sharing computers;

encrypting the second combination;

comparing the encrypted second combination to the encrypted first combination; and

in response to determining the encrypted second combination matches the encrypted first combination, accepting the second client request.

2. The method of claim 1, wherein the distributed file sharing system is a Network File System (NFS).

3. The method of claim 1, wherein the distributed file sharing system does not include one or more proxy servers to perform a file sharing operation.

4. The method of claim 1, wherein the step of generating the first combination and the step of generating the second combination that includes information about the client computer received from the first client request and received from the second client request, further includes information about the client computer including an IP address of the client computer and a transport protocol port number used by the client computer to communicate with the one or more file sharing computers.

5. The method of claim 1, wherein the step of generating the first combination, and the step of generating the second combination, further comprises:

performing one or more operations on an IP address of the client computer, a transport protocol port number used by the client computer to communicate with the one or more file sharing computers, the standard file handle and the key that includes the random value that is restricted to the one or more file sharing computers.

6. The method of claim 1, wherein the step of encrypting the first combination and the step of encrypting the second combination, further comprises:

encrypting the first combination and the second combination by performing a cryptographic hash function to the first combination and to the second combination.