Method and system for cached document search

Patent metadata

Field	Value
Publication number	US-10691757-B1
Application number	US-201615279883-A
Country	US
Kind code	B1
Filing date	Sep 29, 2016
Priority date	Sep 29, 2016
Publication date	Jun 23, 2020
Grant date	Jun 23, 2020

Abstract

A method for servicing document search requests. The method includes receiving, by a document management service, a document search query from a requesting user, identifying, in a document repository, by the document management service, a document that matches the search query, and obtaining a permission level by the document management service, from an access control cache, based on a combination of the requesting user and an access control list required by the document. The access control cache is located on the document management service, and the access control cache is populated using content in an access control repository located on a repository server, separate from the document management service. The method further includes making a determination that the permission level is sufficient and based on the determination, returning the document to the requesting user, as a search result.

First claim

What is claimed is:

1. A method for servicing document search requests, comprising:
receiving, by a document management service, a document search query from a requesting user;
identifying, in a document repository, by the document management service, a document that matches the document search query;
generating, by the document management service, an entry for the requesting user in a user group cache, comprising:
identifying, in a user group repository, ancestor groups of the requesting user, wherein the ancestor groups comprise parent and grandparent groups; and
generating, in the user group cache, the entry that associates identified ancestor groups with the requesting user;

obtaining, by the document management service, a permission level from an access control cache, wherein the permission level is based on:
the entry; and content of an access control repository,
wherein the access control cache is located on the document management service, and
wherein the access control repository and the document repository are located on a repository server, separate from the document management service;

making a first determination that the permission level is sufficient; and
returning, based on the first determination, the document to the requesting user as a search result.

2. The method of claim 1 , wherein populating the access control cache comprises:
selecting, in the user group cache, the ancestor groups associated with the requesting user;
making a second determination that one of the associated ancestor groups matches an accessor in the access control repository;
obtaining, based on the second determination, an accessor permission level from the access control repository; and
storing, in the access control cache, an entry for the requesting user, comprising the accessor permission level.

3. The method of claim 1 , further comprising:
making a second determination that at least one selected from a group consisting of the user group repository and the access control repository has changed, and based on the second determination:
updating at least one of the access control cache and the user group cache.

4. The method of claim 3 , wherein updating at least one of the access control cache and the user group cache comprises making a third determination that a user was added to a user group, in the user group repository, and based on the third determination:
identifying, in the user group repository, ancestor groups of the added user;
for each of the identified ancestor groups, in the user group cache, associating the ancestor group with the added user, in the user group cache; and
purging an entry for the added user, in the access control cache.

5. The method of claim 3 , wherein updating at least one of the access control cache and the user group cache comprises making a third determination that a user group was added in the user group repository, and based on the third determination:
identifying, in the user group cache, user entries that are affected by the added user group;
for each of the identified user entries:
associating ancestor groups to which the user group was added with the user entry; and
purging the identified user entry, in the access control cache.

6. The method of claim 3 , wherein updating at least one of the access control cache and the user group cache comprises making a third determination that a user was removed from a user group in the user group repository, and based on the third determination:
removing ancestor groups that are associated with the removed user from the user group cache;
identifying, in the user group repository, ancestor groups of the removed user;
for each of the identified ancestor groups, associating the ancestor group with a user entry for the removed user, in the user group cache; and
purging the user entry for the removed user, in the access control cache.

7. The method of claim 3 , wherein updating at least one of the access control cache and the user group cache comprises making a third determination that a user group was removed in the user group repository, and based on the third determination:
identifying, in the user group cache, user entries with which the removed group is associated;
for each of the identified user entries:
identifying ancestor groups and associating re-identified ancestor groups with the user entry; and
purging the identified user entry in the access control cache.

8. The method of claim 3 , wherein updating at least one of the access control cache and the user group cache comprises making a third determination that the access control repository has changed, and based on the third determination:
identifying, in the access control cache, access control list entries that are affected by the change; and
removing the identified access control list entries from the access control cache.

9. A non-transitory computer readable medium (CRM) comprising instructions that enable a system for servicing document search requests to:
receive, by a document management service, a document search query from a requesting user;
identify, in a document repository, by the document management service, a document that matches the document search query;
generate, by the document management service, an entry for the requesting user in a user group cache, comprising:
identifying, in a user group repository, ancestor groups of the requesting user, wherein the ancestor groups comprise parent and grandparent groups; and
generating, in the user group cache, the entry that associates identified ancestor groups with the requesting user;

obtain, by the document management service, a permission level from an access control cache, wherein the permission level is based on:
the entry; and content of an access control repository,
wherein the access control cache is located on the document management service, and
wherein the access control repository and the document repository are located on a repository server, separate from the document management service;

make a first determination that the permission level is sufficient; and
return, based on the first determination, the document to the requesting user as a search result.

10. The non-transitory CRM of claim 9 , wherein populating the access control cache comprises:
selecting, in the user group cache, the ancestor groups associated with the requesting user;
making a second determination that one of the associated ancestor groups matches an accessor in the access control repository;
obtaining an accessor permission level from the access control repository; and
storing, in the access control cache, an entry for the requesting user, comprising the accessor permission level.

11. The non-transitory CRM of claim 9 , wherein populating the access control cache comprises:
identifying, in the access control repository, an entry for an accessor that matches the requesting user;
obtaining, from the identified entry, an accessor permission level; and
storing, in the access control cache, an entry for the requesting user, comprising the accessor permission level.

12. The non-transitory CRM of claim 9 , wherein the instructions further enable the system for servicing document search requests to:
make a second determination that at least one selected from a group consisting of the user group repository and the access control repository has changed, and based on the second determination:
update at least one of the access control cache and the user group cache.

13. A system for servicing document search requests, the system comprising:
a processor, wherein the processor is an integrated circuit;

Assignees

• Emc Ip Holding Co Llc

Inventors

• Chen Chao
• Liu Jingjing
• Zhang Lei
• Huang Kunwu
• Dai Hongtao
• Teng Ying

Classifications

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F16/93 Primary

  Document management systems · CPC title

• H04L63/105 Primary

  Multiple levels of security · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title