Systems and methods for facilitating access to private files using a cloud storage system

• US 9,251,114 B1
• Filed: 10/14/2013
• Issued: 02/02/2016
• Est. Priority Date: 10/12/2012
• Status: Active Grant

• Current Assignee: Egnyte Incorporated
• Original Assignee: Egnyte Incorporated
• Inventors: Chen, Xi, Jassal, Amrit, Kavasseri, Ramanathan, Wijayaratne, Ravi, Sharma, Shishir, Ancin, Hakan, Jung, Daniel H., Neustaetter, Gregory B., Puttergill, Sean H., Sundararaj, Ramakrishnan, Vedanthan, Sanjay, Yalangi, Chandra
• Primary Examiner(s): BOUTAH, ALINA A
• Application Number:
  US14/053,357
• Time in Patent Office: 841 Days
• Field of Search: 709/223, 709/217, 709/219, 709/225, 709/229, 709/243, 709/249, 709/213, 709/203, 707/999.01, 707/610
• US Class Current: 1/1
• CPC Class Codes: G06F 15/17331 Distributed shared memory [DSM], e.g. remote direct memory access [RDMA]
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/14 Details of searching files based on file metadata
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: G06F 16/1844 Management specifically adapted to replicated file systems
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method for providing access to objects associated with a particular client in a cloud storage system is disclosed. The method includes the steps of establishing a connection with a user, providing a client namespace associated with the client to the user, where the client namespace represents objects stored on the cloud storage system and objects stored on a private storage system apart from the cloud storage system, receiving a request from the user to access an object stored on the private storage system, and providing information to the user to facilitate access to the object stored on the private storage system by said user. Other systems and methods are also disclosed. Important advantages of the present invention are facilitated by separating the logic for user access (control plane) from the actual storage (Storage plane). Private file system access can still be managed from the cloud, while keeping the client data private.

Claims

1. In a cloud storage system, a method for providing access to objects associated with a particular client, said method comprising:

establishing a connection with a user associated with said client over a network;

providing a client namespace associated with said client to said user, said client namespace representing objects stored on said cloud storage system and objects stored on a private storage system apart from said cloud storage system;

receiving a request from said user to access an object stored on said private storage system; and

providing information to said user to facilitate access to said object stored on said private storage system by said user; and

wherein

said step of providing said client namespace to said user includes

providing a first portion of said client namespace to said user based on objects stored on said cloud storage system and

providing information to said user to enable said user to retrieve a second portion of said client namespace from said private storage system, thereby also providing at least a portion of said information to facilitate access to said object on said private storage system by said user.

2. The method of claim 1, wherein said information includes connection information enabling said user to establish a separate connection with said private storage system.

3. The method of claim 2, wherein said connection information includes HTTP(S) endpoint information associated with said private storage system.

4. The method of claim 3, wherein said endpoint information indicates a read-only endpoint.

5. The method of claim 1, further comprising redirecting said user to said private storage system in response to receiving said request from said user to access said object.

6. The method of claim 1, further comprising:

establishing a second connection with said private storage system;

requesting access to said object on behalf of said user via said second connection;

gaining access to said requested object via said second connection; and

providing access to said requested object to said user via said connection.

7. The method of claim 1, wherein:

said step of providing said client namespace includes providing a client namespace further representing objects stored on a second private storage system apart from said cloud storage system; and

said method further comprises

receiving a request from said user to access an object stored on said second private storage system; and

providing information to said user to facilitate access to said object stored on said second private storage system by said user.

8. The method of claim 7, wherein said step of providing said client namespace to said user includes:

providing a first portion of said client namespace to said user based on objects stored on said cloud storage system;

providing information to said user to enable said user to retrieve a second portion of said client namespace from said private storage system; and

providing information to said user to enable said user to retrieve a third portion of said client namespace from said second private storage system.

9. The method of claim 8, wherein said step of establishing said connection with said user includes establishing said connection with said user via said private storage system.

10. The method of claim 1, wherein said step of providing said client namespace to said user includes generating the entirety of said client namespace from information stored on said cloud storage system.

11. A non-transitory, electronically-readable storage medium having code embodied therein for causing an electronic device to perform a method for providing access to objects associated with a particular client, said code being operative to cause said electronic device to:

establish a connection with a user associated with said client over a network;

provide a client namespace associated with said client to said user, said client namespace representing objects stored on a cloud storage system and objects stored on a private storage system apart from said cloud storage system;

receive a request from said user to access an object stored on said private storage system; and

provide information to said user to facilitate access to said object stored on said private storage system by said user; and

wherein

to provide said client namespace to said user includes, said code is further operative to cause said electronic device to

provide a first portion of said client namespace to said user based on objects stored on said cloud storage system and

provide information to said user to enable said user to retrieve a second portion of said client namespace from said private storage system, thereby also providing at least a portion of said information to facilitate access to said object on said private storage system by said user.

12. The non-transitory, electronically-readable storage medium of claim 11, wherein said information includes connection information enabling said user to establish a separate connection with said private storage system.

13. The non-transitory, electronically-readable storage medium of claim 12, wherein said connection information includes HTTP(S) endpoint information associated with said private storage system.

14. The non-transitory, electronically-readable storage medium of claim 13, wherein said endpoint information indicates a read-only endpoint.

15. The non-transitory, electronically-readable storage medium of claim 11, wherein said code is further operative to cause said electronic device to redirect said user to said private storage system in response to receiving said request from said user to access said object.

16. The non-transitory, electronically-readable storage medium of claim 11, wherein said code is further operative to cause said electronic device to:

establish a second connection with said private storage system;

request access to said object on behalf of said user via said second connection;

gain access to said requested object via said second connection; and

provide access to said requested object to said user via said connection.

17. The non-transitory, electronically-readable storage medium of claim 11, wherein said code is further operative to cause said electronic device to:

provide a client namespace further representing objects stored on a second private storage system apart from said cloud storage system;

receive a request from said user to access an object stored on said second private storage system; and

provide information to said user to facilitate access to said object stored on said second private storage system by said user.

18. The non-transitory, electronically-readable storage medium of claim 17, wherein, to provide said client namespace to said user, said code is operative to cause said electronic device to:

provide a first portion of said client namespace to said user based on objects stored on said cloud storage system;

provide information to said user to enable said user to retrieve a second portion of said client namespace from said private storage system; and

provide information to said user to enable said user to retrieve a third portion of said client namespace from said second private storage system.

19. The non-transitory, electronically-readable storage medium of claim 18, wherein, to establish said connection with said user, said code is operative to cause said electronic device to establish said connection with said user via said private storage system.

20. The non-transitory, electronically-readable storage medium of claim 11, wherein, to provide said client namespace to said user, said code is operative to cause said electronic device to generate the entirety of said client namespace from information stored on said cloud storage system.

21. A cloud storage system for providing access to objects associated with a particular client, said cloud storage system comprising:

memory for storing data and code;

at least one processing unit for executing said code, said code including a namespace module operative to

provide a client namespace associated with said client, said client namespace representing objects stored on said cloud storage system and objects stored on a private storage system apart from said cloud storage system and

provide information to facilitate access to one of said objects stored on said private storage system; and

at least one network interface operative to

establish a network connection with a user associated with said client,

provide said client namespace to said user,

receive a request from said user to access an object stored on said private storage system, and

provide said information to facilitate access to said object to said user.

22. The system of claim 21, wherein said namespace module is further operative to:

provide a first portion of said client namespace based on objects stored on said cloud storage system; and

provide information to enable said user to retrieve a second portion of said client namespace from said private storage system, thereby also providing at least a portion of said information to facilitate access to said object on said private storage system by said user.

23. The system of claim 22, wherein said information includes connection information associated with said private storage system.

24. The system of claim 23, wherein said connection information includes HTTP(S) endpoint information associated with said private storage system.

25. The system of claim 21, wherein said information includes connection information enabling said user to establish a separate connection with said private storage system.

26. The system of claim 25, wherein said connection information includes HTTP(S) endpoint information associated with said private storage system.

27. The system of claim 26, wherein said endpoint information indicates a read-only endpoint.

28. The system of claim 21, wherein said namespace module is further operative to redirect said user to said private storage system in response to said network interface receiving said request from said user to access said object.

29. The system of claim 21, wherein:

said network interface is further operative to establish a second connection with said private storage system; and

said namespace module is further operative to

request access to said object on behalf of said user via said second connection,

gain access to said requested object via said second connection, and

proxy access to said requested object on behalf of said user.

30. The system of claim 21, wherein said namespace module is further operative to:

provide a client namespace further representing objects stored on a second private storage system apart from said cloud storage system; and

provide information to facilitate access to one of said objects stored on said second private storage system.

31. The system of claim 30, wherein said namespace module is further operative to:

provide a first portion of said client namespace based on objects stored on said cloud storage system;

provide information to enable said user to retrieve a second portion of said client namespace from said private storage system; and

provide information to enable said user to retrieve a third portion of said client namespace from said second private storage system.

32. The system of claim 30, wherein said network interface is operative to establish said connection with said user via said private storage system.

33. The system of claim 21, wherein said namespace module is operative to generate the entirety of said client namespace from information stored on said cloud storage system.

34. A cloud storage system for providing access to objects associated with a particular client, said cloud storage system comprising:

memory for storing data and code;

at least one processing unit for executing said code;

means for providing a client namespace representing objects stored on said cloud storage system and objects stored on a private storage system apart from said cloud storage system;

means for providing information to facilitate access to one of said objects stored on said private storage system; and

at least one network interface operative to

establish a network connection with a user associated with said client,

provide said client namespace to said user,

receive a request from said user to access an object stored on said private storage system, and

provide said information to facilitate access to said object to said user.

35. A method for providing access to files associated with a particular client, said method comprising:

identifying a client file system to be accessed remotely, said client file system being stored on at least one client storage system;

synchronizing a first portion of said client file system with a cloud storage system located remotely from said client storage system;

retaining a second portion of said client file system on said client storage system as a private file system but not on said cloud storage system;

providing access information to said cloud storage system to enable a remote user to directly access said private file system;

establishing a connection with a local user associated with said client;

establishing a second connection with said cloud storage system;

accessing a client namespace associated with said client via said second connection, said client namespace representing objects stored on said cloud storage system and objects stored on said at least one client storage system; and

requesting access to one of said objects of said client namespace on behalf of said local user.

36. The method of claim 35, wherein:

said requested object is stored on a second client storage system associated with said client and located remotely from said cloud storage system; and

said method further comprises

receiving connection information associated with said second client storage system from said cloud storage system;

using said connection information to establish a third connection with said second client storage system; and

requesting access to said requested object on said second client storage system.

37. The method of claim 35, wherein:

said requested object is stored on a second client storage system associated with said client and located remotely from said cloud storage system; and

said method further comprises obtaining access to said requested object via said cloud storage system.

38. The method of claim 35, further comprising:

establishing a third connection with a mobile user associated with said client;

receiving an access request from said mobile user requesting access to said private file system; and

providing said requested access via said third connection.

39. The method of claim 38, wherein said access request is received at an HTTP(S) endpoint.

40. The method of claim 38, wherein said step of providing said requested access includes:

authenticating said mobile user with said client storage system; and

providing said requested access in accordance with access control policies of said client storage system.

41. The method of claim 35, wherein:

each private file associated with said private file system includes a data file and associated client metadata; and

said method further comprises synchronizing said client metadata associated with some of said private files with said cloud storage system.

42. The method of claim 35, wherein said access information includes HTTP(S) endpoint information.

43. A non-transitory, electronically-readable storage medium having code embodied therein for causing an electronic device to perform a method for providing access to files associated with a particular client, said code causing said electronic device to:

identify a client file system to be accessed remotely, said client file system being stored on at least one client storage system;

synchronize a first portion of said client file system with a cloud storage system located remotely from said client storage system;

retain a second portion of said client file system on said client storage system as a private file system but not on said cloud storage system;

provide access information to said cloud storage system to enable a remote user to directly access said private file system;

establish a connection with a local user associated with said client;

establish a second connection with said cloud storage system;

access a client namespace associated with said client via said second connection, said client namespace representing objects stored on said cloud storage system and objects stored on said at least one client storage system; and

request access to one of said objects of said client namespace on behalf of said local user.

44. The non-transitory, electronically-readable storage medium of claim 43, wherein:

said requested object is stored on a second client storage system associated with said client and located remotely from said cloud storage system; and

said code is further operative to cause said electronic device to

receive connection information associated with said second client storage system from said cloud storage system;

use said connection information to establish a third connection with said second client storage system; and

request access to said requested object on said second client storage system.

45. The non-transitory, electronically-readable storage medium of claim 43, wherein:

said requested object is stored on a second client storage system associated with said client and located remotely from said cloud storage system; and

said code is further operative to cause said electronic device to obtain access to said requested object via said cloud storage system.

46. The non-transitory, electronically-readable storage medium of claim 43, wherein said code is further operative to cause said electronic device to:

establish a third connection with a mobile user associated with said client;

receive an access request from said mobile user requesting access to said private file system; and

provide said requested access via said third connection.

47. The non-transitory, electronically-readable storage medium of claim 46, wherein said access request is received at an HTTP(S) endpoint.

48. The non-transitory, electronically-readable storage medium of claim 46, wherein, to provide said requested access, said code is operative to cause said electronic device to:

authenticate said mobile user with said client storage system; and

provide said requested access in accordance with access control policies of said client storage system.

49. The non-transitory, electronically-readable storage medium of claim 43, wherein:

each private file associated with said private file system includes a data file and associated client metadata; and

said code is further operative to cause said electronic device to synchronize said client metadata associated with some of said private files with said cloud storage system.

50. The non-transitory, electronically-readable storage medium of claim 43, wherein said access information includes HTTP(S) endpoint information.

51. A client storage system for providing access to files associated with a particular client, said system comprising:

a network interface operative to

establish a connection with a local user associated with said client and

establish a second connection with a cloud storage system;

a storage device for storing data and code, said data including a client file system to be accessed remotely, said client file system including a first portion synchronized with said cloud storage system and a second portion retained in said storage device as a private file system but not on said cloud storage system, said cloud storage system being located remotely from said client storage system; and

at least one processing unit operative to execute said code, said code including

a synchronizer operative to synchronize said first portion of said client file system with said cloud storage system and

a storage connect appliance operative to

provide access information to said cloud storage system to enable a remote user to directly access said private file system,

access a client namespace associated with said client via said second connection, said client namespace representing objects stored on said cloud storage system and objects stored on said at least one client storage system, and

request access to one of said objects of said client namespace on behalf of said local user.

52. The system of claim 51, wherein:

said requested object is stored on a second client storage system associated with said client and located remotely from said cloud storage system; and

said storage connect appliance is further operative to

receive connection information associated with said second client storage system from said cloud storage system;

use said connection information to establish a third connection with said second client storage system; and

request access to said requested object on said second client storage system.

53. The system of claim 51, wherein:

said requested object is stored on a second client storage system associated with said client and located remotely from said cloud storage system; and

said storage connect appliance is operative to obtain access to said requested object via said cloud storage system.

54. The system of claim 51, wherein:

said network interface is operative to establish a third connection with a mobile user associated with said client; and

said storage connect appliance is further operative to

receive an access request from said mobile user requesting access to said private file system; and

provide said requested access via said third connection.

55. The system of claim 54, wherein said access request is received at an HTTP(S) endpoint.

56. The system of claim 54, wherein said storage connect appliance is further operative to:

authenticate said mobile user with said storage device; and

provide said requested access in accordance with access control policies of said storage device.

57. The system of claim 51, wherein:

each retained file includes a data file and associated client metadata; and

said client metadata associated with some of said retained files is stored in said cloud storage system.

58. The system of claim 51, wherein said access information includes HTTP(S) endpoint information.

59. A client storage system for providing access to files associated with a particular client, said system comprising:

a network interface operative to

establish a connection with a local user associated with said client and

establish a second connection with a cloud storage system;

a storage device for storing data and code, said data including a client file system to be accessed remotely, said client file system including a first portion synchronized with said cloud storage system and a second portion retained in said memory but not on said cloud storage system, said cloud storage system being located remotely from said client storage system;

means for providing access information to said cloud storage system to enable a remote user to directly access said private file system;

means for accessing a client namespace associated with said client via said second connection, said client namespace representing objects stored on said cloud storage system and objects stored on said at least one client storage system; and

means for requesting access to one of said objects of said client namespace on behalf of said local user.