Multiprotocol access control list with guaranteed protocol compliance
First Claim
Patent Images
1. A method of access rights validation for a multiprotocol supported file server, comprising:
- receiving a request to store a file on a file server from an owner protocol, the request to store comprising the file and a security descriptor;
storing the file on the file server;
storing the security descriptor according to a specification of the owner protocol in an extended attribute associated with the file;
receiving a request to open the file from a requestor protocol having a user ID;
expanding the security descriptor to extract a set of ACEs (access control entries), wherein the set of ACEs comprises at least one of an NTFS, an NFS, and a POSIX access control entry;
transforming the user ID to a mapped ID according to the specification of the owner protocol; and
validating the mapped ID against the set of ACEs expanded from the security descriptor according to the specification of the owner protocol.
1 Assignment
0 Petitions
Accused Products
Abstract
An approach to multiprotocol ACL implementation with guaranteed protocol compliance is described. In one approach, a method of access rights validation for a multiprotocol supported file server is detailed. The method involves receiving a request to store a file with a security descriptor and storing the security descriptor in an extended attribute associated with the file. Subsequently, the security descriptor is expanded to extract a set of ACEs. Access to the file can then be validated against the ACEs expanded from the security descriptor according to the specifications of the protocol that created the security descriptor.
-
Citations
20 Claims
-
1. A method of access rights validation for a multiprotocol supported file server, comprising:
-
receiving a request to store a file on a file server from an owner protocol, the request to store comprising the file and a security descriptor; storing the file on the file server; storing the security descriptor according to a specification of the owner protocol in an extended attribute associated with the file; receiving a request to open the file from a requestor protocol having a user ID; expanding the security descriptor to extract a set of ACEs (access control entries), wherein the set of ACEs comprises at least one of an NTFS, an NFS, and a POSIX access control entry; transforming the user ID to a mapped ID according to the specification of the owner protocol; and validating the mapped ID against the set of ACEs expanded from the security descriptor according to the specification of the owner protocol. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. An apparatus for performing access rights validation for a multiprotocol supported file server, comprising:
-
a main memory; a data storage device; and a processor communicatively coupled to the main memory and the data storage device that receives a request to store a file on the data storage device from an owner protocol, the request to store comprising the file and a security descriptor, stores the file on the data storage device, stores the security descriptor according to a specification of the owner protocol in an extended attribute associated with the file, receives a request to open the file from a requestor protocol having a user ID, expands the security descriptor to extract a set of ACEs (access control entries) in the main memory, wherein the set of ACEs comprises at least one of an NTFS, an NFS, and a POSIX access control entry, transforms the user ID to a mapped ID according to the specification of the owner protocol, and validates the mapped ID against the set of ACEs expanded from the security descriptor according to the specification of the owner protocol. - View Dependent Claims (12, 13, 14, 15, 16)
-
-
17. An apparatus for providing access rights validation for a multiprotocol supported file server, comprising:
-
a multiprotocol access handler circuit configured to receive a request to store a file on a file system from an owner protocol, the request to store comprising the file and a security descriptor; and memory coupled to the multiprotocol access handler circuit configured to; store the file on the file server; store the security descriptor according to a specification of the owner protocol in an extended attribute associated with the file; and expand the security descriptor to extract a set of ACEs (access control entries) in response to receiving a request to open the file from a requestor protocol having a user ID, wherein the user ID is transformed to a mapped ID according to the specification of the owner protocol, and the mapped ID is validated against the set of ACEs expanded from the security descriptor by the multiprotocol access handler circuit according to the specification of the owner protocol, wherein the set of ACEs comprises at least one of an NTFS, an NFS, and a POSIX access control entry. - View Dependent Claims (18, 19, 20)
-
Specification