Systems and methods for facilitating access to private files using a cloud storage system

• US 9,922,203 B2
• Filed: 01/29/2016
• Issued: 03/20/2018
• Est. Priority Date: 10/12/2012
• Status: Active Grant

• Current Assignee: Egnyte Incorporated
• Original Assignee: Egnyte Incorporated
• Inventors: Ancin, Hakan, Chen, Xi, Jassal, Amrit, Jung, Daniel H., Neustaetter, Gregory B., Puttergill, Sean H., Sundararaj, Ramakrishnan, Vedanthan, Sanjay, Yalangi, Chandra, Kavasseri, Ramanathan, Wijayaratne, Ravi, Sharma, Shishir
• Primary Examiner(s): Boutah, Alina A
• Application Number:
  US15/010,703
• Publication Number:
  US 20160149926A1
• Time in Patent Office: 781 Days
• Field of Search: 709217-219, 726 1, 726 27
• CPC Class Codes: G06F 15/17331 Distributed shared memory [DSM], e.g. remote direct memory access [RDMA]
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/14 Details of searching files based on file metadata
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: G06F 16/1844 Management specifically adapted to replicated file systems
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method for providing access to objects associated with a particular client in a cloud storage system is disclosed. The method includes the steps of establishing a connection with a user, providing a client namespace associated with the client to the user, where the client namespace represents objects stored on the cloud storage system and objects stored on a private storage system apart from the cloud storage system, receiving a request from the user to access an object stored on the private storage system, and providing information to the user to facilitate access to the object stored on the private storage system by said user. Other systems and methods are also disclosed. Important advantages of the present invention are facilitated by separating the logic for user access (control plane) from the actual storage (Storage plane). Private file system access can still be managed from the cloud, while keeping the client data private.

Claims

1. A method for providing remote access to files stored on at least one client storage system, said method comprising:

identifying a client file system to be accessed remotely by a remote user, said client file system being stored on said at least one client storage system;

associating some data files of said identified client file system with a first use case and other data files of said identified client file system with a second use case;

synchronizing data files associated with said first use case with a cloud storage system located remotely from said client storage system such that said data files associated with said first use case are accessible to said remote user on said cloud storage system;

retaining data files associated with said second use case on said client storage system as private data files of a private file system that are not stored on said cloud storage system; and

providing access information associated with said private file system to said cloud storage system, said access information enabling said remote user, having acquired at least some of said access information from said cloud storage system, to remotely retrieve a private namespace associated with at least a portion of said private file system from said client storage system and to remotely access ones of said private data files on said client storage system.

2. The method of claim 1, further comprising:

establishing a connection with said remote user;

receiving an access request from said remote user requesting access to said private file system; and

providing said requested access via said connection.

3. The method of claim 2, wherein said access request is received at an HTTPS endpoint specified in said access information.

4. The method of claim 2, wherein said step of providing said requested access includes:

authenticating said remote user with said client storage system; and

providing said requested access in accordance with access control policies of said client storage system.

5. The method of claim 2, wherein said step of providing said requested access includes providing said private namespace associated with at least said portion of said private file system to said remote user.

6. The method of claim 5, further comprising providing said remote user access to ones of said private data files identified in said private namespace.

7. The method of claim 2, wherein said connection is established with said remote user via said remote storage system.

8. The method of claim 2, further comprising:

receiving a request from said remote user to generate a hyperlink associated with a portion of said private file system;

generating said hyperlink; and

transmitting said hyperlink to a second remote user.

9. The method of claim 1, wherein said access information includes HTTPS endpoint information associated with said at least one client storage system.

10. A client storage system for providing remote access to files stored on said client storage system, said client storage system comprising:

a network interface;

at least one processing unit;

a storage device for storing data and code, said data including a client file system to be accessed remotely, said client file system including

data files associated with a first use case that are synchronized with a cloud storage system located remotely from said client storage system such that said data files associated with said first use case are accessible to a remote user on said cloud storage system and

data files associated with a second use case that are retained in said storage device as private data files of a private file system and are not stored on said cloud storage system;

a synchronizer operative to synchronize said data files associated with said first use case with said cloud storage system; and

a storage connector operative to

associate some data files of said client file system with said first use case and other data files of said client file system with said second use case and

provide access information associated with said private file system to said cloud storage system, said access information enabling said remote user, having acquired at least some of said access information from said cloud storage system, to remotely retrieve a private namespace associated with at least a portion of said private file system from said client storage system and to remotely access ones of said private data files stored on said storage device.

11. The system of claim 10, wherein:

said network interface is operative to establish a connection with said remote user; and

said storage connector is further operative to

receive an access request from said remote user requesting access to said private file system; and

provide said requested access via said connection.

12. The system of claim 11, wherein said access request is received at an HTTPS endpoint specified in said access information.

13. The system of claim 11, wherein said storage connector is further operative to:

authenticate said remote user; and

provide said requested access in accordance with access control policies of said storage device.

14. The system of claim 11, wherein, responsive to said access request, said storage connector is operative to provide said private namespace associated with at least said portion of said private file system to said remote user.

15. The system of claim 14, wherein said storage connector is further operative to provide said remote user access to ones of said private data files identified in said private namespace.

16. The system of claim 11, wherein said connection is established with said remote user via said remote storage system.

17. The system of claim 11, wherein said storage connector is further operative to:

receive a request from said remote user to generate a hyperlink associated with a portion of said private file system;

generate said hyperlink; and

transmit said hyperlink to a second remote user.

18. The system of claim 10, wherein said access information includes HTTPS endpoint information associated with said client storage system.

19. A client storage system for providing remote access to files stored on said client storage system, said client storage system comprising:

a network interface;

at least one processing unit;

a storage device for storing data and code, said data including a client file system to be accessed remotely, said client file system including

data files associated with a first use case that are synchronized with a cloud storage system located remotely from said client storage system such that said data files associated with said first use case are accessible to a remote user on said cloud storage system and

data files associated with a second use case that are retained in said storage device as private data files of a private file system and are not stored on said cloud storage system;

a synchronizer operative to synchronize said data files associated with said first use case with said cloud storage system;

means for associating some data files of said client file system with said first use case and other data files of said client file system with said second use case; and

means for providing access information to said cloud storage system, said access information enabling said remote user, having acquired at least some of said access information from said cloud storage system, to remotely retrieve a private namespace associated with at least a portion of said private file system from said client storage system and to remotely access ones of said private data files stored on said storage device.

20. A non-transitory, electronically-readable storage medium having code embodied therein for causing an electronic device to perform a method for providing remote access to files stored on at least one client storage system, said code causing said electronic device to:

identify a client file system to be accessed remotely by a remote user, said client file system being stored on at least one client storage system;

associate some data files of said identified client file system with a first use case and other data files of said identified client file system with a second use case;

synchronize data files associated with said first use case with a cloud storage system located remotely from said client storage system such that said data files associated with said first use case are accessible to said remote user on said cloud storage system;

retain data files associated with said second use case on said client storage system as private data files of a private file system that are not stored on said cloud storage system; and

provide access information associated with said private file system to said cloud storage system, said access information enabling said remote user, having acquired at least some of said access information from said cloud storage system, to remotely retrieve a private namespace associated with at least a portion of said private file system from said client storage system and to remotely access ones of said private data files on said client storage system.