Distributed data storage by means of authorisation token

Patent metadata

Field	Value
Publication number	US-11475137-B2
Application number	US-201916563323-A
Country	US
Kind code	B2
Filing date	Sep 6, 2019
Priority date	Sep 17, 2014
Publication date	Oct 18, 2022
Grant date	Oct 18, 2022

Abstract

A file management server may include a processor, a network interface for operatively coupling the file management server to a user computer system and to memory services via a network. The file management server includes a file management application configured to receive an authorisation enquiry of the user computer system to store file fragments of a file via the network in a plurality of the memory services; and in response to the receipt of the authorisation enquiry, request an authorisation token from each of the memory services and forward, to the user computer system, authorisation tokens formed as URLs and obtained in response to the request. Each URL enables direct write or direct read access to a storage space of one of the memory services identified by the URL. Metadata that allows reconstruction of the file from the stored file fragments is protected against access by the memory services.

First claim

The invention claimed is:

1. A method for storing data, wherein the method comprises the following steps in order to store a file:
automatically generating a distribution schedule, which contains instructions for generating file fragments of the file by means of an error correction method and identifiers of a number of memory services, in a non-volatile storage medium of which the generated file fragments are to be stored, by a file management server or by a user computer system assigned to a user;
performing the error correction method specified in the distribution schedule for generation of the file fragments from the file by the user computer system, wherein at least one of the file fragments contains error correction bits;
sending an authorisation enquiry of the user computer system for storing the file fragments in the memory services identified in the distribution schedule to the file management server via a network;
in response to receipt of the authorisation enquiry, authorizing the user computer system and checking, by the file management server, whether the user to whom the computer system is assigned has access rights in order to store the file by means of the identified memory services;
only following successful authorization and only if the user has access rights, requesting an authorisation token by the file management server from each of the memory services identified in the distribution schedule and forwarding the authorisation tokens obtained in response to the request to the user computer system by the file management server, wherein the authorisation tokens are formed as URLs, which each enable direct write or direct read access to a storage space on the storage medium of one of the memory services identified by the URL;
storing the generated file fragments via the network in the storage media of the identified memory devices by means of authorisation verification by the authorisation tokens, with the user computer system bypassing the file management server,
wherein metadata, which allow the reconstruction of the file from the stored file fragments, are generated by the user computer system and stored in the user computer system and/or the file management server and are protected against access by the memory services; and
using the metadata by the file management server to control the access of a further user to the file, wherein the further user being assigned to a further user computer system.

2. The method according to claim 1 , comprising the following steps:
providing a configuration, which contains requirements of a user with regard to the speed, the geographical location, the security and/or the costs of an IT infrastructure to be used for the storing of data and also requirements with regard to the availability of the data to be stored;
providing a memory service catalogue, which comprises specifications of a multiplicity of available memory services, wherein the specification of each of the memory services contains details with regard to the speed, the geographical location, the security and/or the costs of an IT infrastructure of the memory service used for the storing of the data;
in order to generate the distribution schedule, automatically evaluating the configuration and the memory service catalogue so as to identify, depending on the specifications of the available memory services and depending on the user requirements, an error correction method from a multiplicity of error correction methods that meets the requirements with regard to the availability of the data to be stored and so as to identify the plurality of memory services identified in the distribution schedule from the multiplicity of available memory services that are suitable for storing the file in accordance with the user-specific requirements with regard to the speed, geographical location, security and/or costs of the IT infrastructure to be used for the storing of data; and;
using the identified error correction method as the error correction method for generating the file fragments of the file according to the distribution schedule.

3. The method according to claim 1 , wherein the metadata include:
paths to all memory locations in the storage media of the memory services in which the file fragments of the file are to be stored or have already been stored; and/or
a symmetric key, which allows a decryption of the file fragment encrypted with this symmetric key; and/or
for each of the file fragments, a hash value of the file fragment calculated by the user computer system; and/or
the original file name of the file stored in a distributed manner, and/or configuration data of the error correction method, and
wherein the method further comprises the following steps:
a mapping of the original file name to the hash values and paths of the generated file fragments;
storing the metadata in the user computer system; and
transferring the metadata to the file management server.

4. The method according to claim 3 , wherein metadata of a multiplicity of files stored in a distributed manner in the memory services are stored in the user computer system and the method comprises a use of said metadata by a client application of the user computer for generation of a client-based view of the files stored in a distributed manner; and/or
wherein metadata of a multiplicity of files stored in the memory services in a distributed manner are stored in the file management server and the method comprises a use of said metadata by a web portal hosted on the file management server for generation of a network-based view of the files stored in a distributed manner,
wherein the client-based and/or the network-based view is configured to dynamically reconstruct the original file names from the metadata and, by selection of one of the files stored in a distributed manner, to initiate a dynamic and automatic reconstruction of the file content of the selected file by the user computer system or by the further user computer system assigned to the further user, the further user computer system being authorized, wherein the memory services in which fragments of the selected file are stored are hidden by the view.

5. The method according to claim 2 , wherein the determination of the error correction method which meets the user requirements with regard to the availability of the file includes a determination of the anticipated total size of all file fragments to be generated by the error correction method, wherein for each of the file fragments to be generated, a memory service is identified which, in accordance with its specifications, meets the requirements with regard to the speed, geographical location, security and/or costs under consideration of the anticipated total size; and/or
wherein, if the determined error correction method would prompt the generation of file fragments of which the total size does not make it possible to identify a sufficient number of memory services which, in accordance with their specifications, meet the requirements with regard to the speed, security and/or costs under consideration of the total size, automatically determining another error correction method, which is configured to generate file fragments of which the anticipated total size is sufficiently small so that, for each file fragment to be generated, a memory service can be identified which, in accordance with its specifications, meets the requirements with regard to the speed, geographical location, security and/or costs under consideration of the anticipated total size; and/or
wherein, in order to meet the user requirements with regard to a maximum duration of the data transfer for the transfer of the file via the network, the determined error correction method is automatically configured so that, as a result of this method, a sufficiently large n

Assignees

• Bundesdruckerei Gmbh

Inventors

• Schnjakin Maxim
• Berger Philipp
• Graupner Hendrik

Classifications

• G06F21/335

  for accessing specific resources, e.g. using Kerberos tickets · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L63/102

  Entity profiles · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title