Determining access changes

Patent metadata

Field	Value
Publication number	US-11803652-B2
Application number	US-202017129386-A
Country	US
Kind code	B2
Filing date	Dec 21, 2020
Priority date	Dec 21, 2020
Publication date	Oct 31, 2023
Grant date	Oct 31, 2023

Abstract

The disclosed technology addresses the need in the art for a content management system that can be highly flexible to the needs of its subjects. The present technology permits any object to be shared by providing a robust and flexible access control list mechanism. The present technology utilizes a data structure that is highly efficient that both minimizes the amount of information that needs to be written into any database, but also allows for fast reads and writes of information from authoritative tables that are a source of truth for the content management system, while allowing for maintenance of indexes containing more refined data that allow for efficient retrieval of certain information that would normally need to be calculated when it is needed.

First claim

What is claimed is:

1. A method comprising:
collecting change information pertaining to an object or a subject in a content management system, wherein collecting change information includes collecting a stream of changes to all descendants of the object, a stream of changes to all ancestors of the object, and a stream of changes to credentials associated with the subject;
merging and sorting the stream of changes to all descendants, the stream of changes to all ancestors, and the stream of changes to credentials associated with the subject into a list;
evaluating each change in the list based on the respective stream of changes that was a source of the change in the list;
determining, based on the list, that the change information has caused a change in an access permission for a subject account with respect to the object; and
sending a notification about the change in the access permission with respect to the object to a client associated with the subject, wherein the notification is different than a synchronization event to synchronize the client to reflect updated objects in a directory resulting from the change in the access permission.

2. The method of claim 1 , wherein the collecting the change information comprises:
determining ancestors of the object; and
prior to sending the notification about the change in the access permissions, evaluating an access control list for the object, where the access control list is based on inherited properties from the ancestors above the object.

3. The method of claim 1 , wherein the collecting the change information comprises:
determining all descendant objects that have changed under the object; and
prior to sending the notification about the change in the access permissions, evaluating an access control list for the object, where the access control list is based on inherited properties from the descendant objects.

4. The method of claim 1 , wherein the collecting the change information comprises:
determining all credentials associated with the subject that have changed; and
prior to sending the notification about the change in the access permissions, evaluating an access control list for the object, where the access control list is based on the credentials associated with the subject that have changed.

5. The method of claim 1 , wherein the list is a time ordered list.

6. The method of claim 1 , wherein the determining that the change information has caused a change in access permission comprises:
determining that change in the list resulted in a change in access permission when a comparison of the access permission by the subject account to the object is different after the change compared to prior to the change.

7. A non-transitory computer readable medium comprising instructions, the instructions, when executed by a computing system, cause the computing system to:
collect change information pertaining to an object or a subject in a content management system, wherein collecting change information includes collecting a stream of changes to all descendants of the object, a stream of changes to all ancestors of the object, and a stream of changes to credentials associated with the subject;
merge and sort the stream of changes to all descendants, the stream of changes to all ancestors, and the stream of changes to credentials associated with the subject into a list;
evaluating each change in the list based on the respective stream of changes that was a source of the change in the list;
determining, based on the list, that the change information has caused a change in an access permission for a subject account with respect to the object; and
send a notification about the change in the access permission with respect to the object to a client associated with the subject.

8. The computer readable medium of claim 7 , wherein the computer readable medium further comprises instructions that, when executed by the computing system, cause the computing system to:
determine ancestors of the object; and
prior to sending the notification about the change in the access permission, evaluate an access control list for the object, wherein the access control list is based on inherited properties from the ancestors above the object.

9. The computer readable medium of claim 7 , wherein the computer readable medium further comprises instructions that, when executed by the computing system, cause the computing system to:
determine all descendant objects that have changed under the object; and
prior to sending the notification about the change in the access permission, evaluate an access control list for the object, wherein the access control list is based on inherited properties from the descendant objects.

10. The computer readable medium of claim 7 , wherein the computer readable medium further comprises instructions that, when executed by the computing system, cause the computing system to:
determine all credentials associated with the subject that have changed; and
prior to sending the notification about the change in the access permission, evaluate an access control list for the object, wherein the access control list is based on the credentials associated with the subject that have changed.

11. The computer readable medium of claim 7 , wherein the list is a time ordered list.

12. The computer readable medium of claim 11 , wherein the computer readable medium further comprises instructions that, when executed by the computing system, cause the computing system to:
determine that change in the time ordered list resulted in a change in the access permission when a comparison of the access permission by the subject account to the object is different after the change compared to prior to the change.

13. A system comprising:
a storage configured to store instructions;
a processor configured to execute the instructions and cause the processor to:
collect change information pertaining to an object or a subject in a content management system, wherein collecting change information includes collecting a stream of changes to all descendants of the object, a stream of changes to all ancestors of the object, and a stream of changes to credentials associated with the subject;
merge and sort the stream of changes to all descendants, the stream of changes to all ancestors, and the stream of changes to credentials associated with the subject into a list;
evaluate each change in the list based on the respective stream of changes that was a source of the change in the list;
determine, based on the list, that the change information has caused a change in an access permission for a subject account with respect to the object; and
send a notification about the change in the access permission with respect to the object to a client associated with the subject.

14. The system of claim 13 , wherein the processor is configured to execute the instructions and cause the processor to:
determine ancestors of the object; and
prior to sending the notification about the change in the access permission, evaluate an access control list for the object, wherein the access control list is based on inherited properties from the ancestors above the object.

15. The system of claim 13 , wherein the processor is configured to execute the instructions and cause the processor to:
determine all descendant objects that have changed under the object; and
prior to sending the notification about the change in the access permission, evaluate an access control list for the object, wherein the access control list is based on inherited properties from the descendant objects.

1

Assignees

• Dropbox Inc

Inventors

• Passey Aaron
• Walker Braden
• Albert Akos

Classifications

• G06F21/6209 Primary

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title