Bundling file permissions for sharing files

• US 9,645,947 B2
• Filed: 05/23/2013
• Issued: 05/09/2017
• Est. Priority Date: 05/23/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Angelo, Mary, Dodson, Brad, Miranda-Steiner, Emmanuel, Nichols, David, Spektor, Daron
• Primary Examiner(s): BURKE, JEFF A
• Application Number:
  US13/901,559
• Publication Number:
  US 20140351541A1
• Time in Patent Office: 1,447 Days
• CPC Class Codes: G06F 12/1416 by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights G06F12/1458 takes precedence
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0643 Management of files
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

When files or other objects are to be shared, a storage system creates a bundle object that identifies the objects to be shared, and the permissions associated with objects in that bundle object. Each object is marked as being associated with a bundle object. When the object is accessed, the storage system determines if the object is associated with a bundle object. The bundle object in turn is accessed to determine the permissions to be associated with that object for the entity accessing the object. Files and other objects can be shared without copying or moving them. Any collection of files or other objects, however selected or identified, can be shared through this mechanism. Using this mechanism, a user can select several files, and then share those files in one operation without copying or moving those files or creating a new folder for those files.

Claims

1. A computer-implemented process performed by a processor in a computer, comprising:

receiving, into memory, an indication of file objects, stored in computer storage and accessible by a first entity through a file system according to first permissions associated with the file objects, to be shared with one or more second entities;

in response to an instruction to share the indicated file objects with the one or more second entities, generating a bundle object;

storing data, for each of the indicated file objects to be shared, such that each of the indicated file objects includes an indication of whether the file object is part of a bundle object;

storing data associated with the bundle object indicating second permissions for the one or more second entities for accessing the file objects associated with the bundle object;

in response to a request associated with an entity to access one of the indicated file objects, determining whether access by the entity is permitted by the first permissions associated with the one of the indicated file objects;

in response to determining that access by the entity is permitted by the first permissions, providing the requested access for the entity; and

in response to determining that access by the entity is not permitted by the first permissions, determining whether the one of the indicated file objects is part of a bundle object based on the stored data for the one of the indicated filed objects and whether access to the one of the indicated file objects is permitted based on the bundle object.

2. The computer-implemented process of claim 1, wherein the second permissions indicate the one or more second entities permitted to access the shared objects.

3. The computer-implemented process of claim 1, wherein the bundle object is created outside of a file system name space for the first entity.

4. The computer-implemented process of claim 1, further comprising:

in response to an entity from among the one or more second entities accessing an object associated with a bundle object, accessing the second permissions from the bundle object; and

determining whether the entity has permission to access the object using the second permissions from the bundle object.

5. The computer-implemented process of claim 1, wherein the storing data indicating that the object is associated with the bundle object is performed without copying or moving the objects to be shared.

6. The computer-implemented process of claim 1, further comprising:

presenting a user interface indicating, for the first entity, file objects shared by the first entity, the user interface indicating bundle objects associated with the first entity and file objects within the bundle objects.

7. The computer-implemented process of claim 1, further comprising:

identifying objects shared with an entity by other entities.

8. An article of manufacture comprising:

computer storage, comprising at least one of a memory device or a storage device, with computer program instructions stored in the computer storage, such that the computer program instructions, when processed by a processing device, instruct the processing device to perform a process comprising;

receiving, into memory, an indication of file objects, stored in computer storage and accessible by a first entity through a file system according to first permissions associated with the file objects, to be shared with one or more second entities;

in response to an instruction to share the indicated file objects with the one or more second entities, generating a bundle object;

storing data, for each of the indicated file objects to be shared, such that each of the indicated file objects includes an indication of whether the file object is part of a bundle object;

storing data associated with the bundle object indicating second permissions for the one or more second entities for accessing the file objects associated with the bundle object;

in response to a request associated with an entity to access one of the indicated file objects, determining whether access by the entity is permitted by the first permissions associated with the one of the indicated file objects;

in response to determining that access by the entity is permitted by the first permissions, providing the requested access for the entity; and

in response to determining that access by the entity is not permitted by the first permissions, determining whether the one of the indicated file objects is part of a bundle object based on the stored data for the one of the indicated filed objects and whether access to the one of the indicated file objects is permitted based on the bundle object.

9. The article of manufacture of claim 8, wherein the second permissions indicate the one or more second entities permitted to access the shared objects.

10. The article of manufacture of claim 8, wherein the bundle object is created outside of a file system name space for the first entity.

11. The article of manufacture of claim 8, wherein the process performed by the processing device further comprises:

in response to an entity from among the one or more second entities accessing an object associated with a bundle object, accessing the second permissions from the bundle object; and

determining whether the entity has permission to access the object using the second permissions from the bundle object.

12. The article of manufacture of claim 8, wherein the storing data indicating that the object is associate with the bundle object is performed without copying or moving the selected file objects.

13. The article of manufacture of claim 8, wherein the process performed by the processing device further comprises:

presenting a user interface indicating, for a first entity, file objects shared by the first entity, the user interface indicating bundle objects associated with the first entity and file objects within the bundle objects.

14. The article of manufacture of claim 8, wherein the process performed by the processing device further comprises:

identifying objects shared with an entity by other entities.

15. A computer system comprising:

one or more server computers connected to one or more storage devices and accessible over a computer network by a plurality of client computers, through which users access the one or more server computers to store file objects in a file system maintained by the server computer for file objects stored on the one or more storage devices, the server computers being configured to;

receive, into memory, an indication of file objects, stored in computer storage and accessible by a first entity through a file system according to first permissions associated with the file objects, to be shared with one or more second entities;

in response to an instruction to share the file objects with the one or more second entities, generate a bundle object;

store data, for each of the indicated file objects to be shared, such that each of the indicated file objects includes an indication of whether the file object is part of a bundle object;

store data associated with the bundle object indicating second permissions for the one or more second entities for accessing the file objects associated with the bundle object;

in response to a request associated with an entity to access one of the indicated file objects, determining whether access by the entity is permitted by the first permissions associated with the one of the indicated file objects;

in response to determining that access by the entity is permitted by the first permissions, providing the requested access for the entity; and

in response to determining that access by the entity is not permitted by the first permissions, determining whether the one of the indicated file objects is part of a bundle object based on the stored data for the one of the indicated filed objects and whether access to the one of the indicated file objects is permitted based on the bundle object.

16. The computer system of claim 15, wherein the second permissions indicate the one or more second entities permitted to access the shared objects.

17. The computer system of claim 15, wherein the bundle object is created outside of a file system name space for the first entity.

18. The computer system of claim 15, wherein the server computers are further configured to, in response to an entity from among the one or more second entities accessing an object associated with a bundle object, access the second permissions from the bundle object, and determine whether the entity has permission to access the object using the second permissions from the bundle object.

19. The computer system of claim 15, wherein the server computers are further configured to present a user interface indicating, for the first entity, file objects shared by the first entity, the user interface indicating bundle objects associated with the first entity and file objects within the bundle objects.

20. The computer system of claim 15, wherein, to store the data indicating that the object is associated with the bundle object, the server computers are further configured to share selected file objects without copying or moving the selected file objects.