Utilizing data views to optimize secure data access in a storage system

Patent metadata

Field	Value
Publication number	US-12001688-B2
Application number	US-202017034361-A
Country	US
Kind code	B2
Filing date	Sep 28, 2020
Priority date	Apr 29, 2019
Publication date	Jun 4, 2024
Grant date	Jun 4, 2024

Abstract

A storage system has filtered views of data. The storage system receives a read request for a filtered view of data in memory. The read request is associated with one or more permissions for viewing the data. The storage system identifies a subset of the data, based on the one or more permissions. The storage system provides the filtered view. The filtered view includes the subset of the data.

First claim

What is claimed is:

1. A storage system comprising:
a memory; and
a processing device, configured to:
receive a read request for a filtered view of data in the memory, the read request associated with at least one permission for viewing the data according to one of a user identifier (UID) and a group identifier (GID);
identify an entity associated with the read request, wherein the at least one permission for viewing the data is based on the entity associated with the read request and a tag of the data associated with one of the UID or the GID;
identify a subset of the data, based on the at least one permission, wherein identification of the subset of the data comprises application of a filter to metadata associated with the subset of data to generate the filtered view;
provide the filtered view comprising the subset of the data;
receive a modification to the subset of the data provided via the filtered view; and
replicate the modification in the data stored in the memory.

2. The storage system of claim 1 , wherein the data corresponds to at least one object stored in the memory.

3. The storage system of claim 1 , wherein the data corresponds to at least one bucket stored in the memory.

4. The storage system of claim 1 , wherein the data corresponds to at least one directory stored in the memory.

5. The storage system of claim 1 , wherein the filtered view reflects a modification to the subset of the data made in another view of the data.

6. The storage system of claim 1 , wherein an application protocol interface (API) command causes the processing device to generate the filtered view of the data associated with the read request.

7. A method comprising:
receiving a read request for a filtered view of data in a memory, the read request associated with at least one permission for viewing the data;
identifying an entity associated with the read request, wherein the at least one permission for viewing the data is based on an entity associated with the read request and a tag of the data associated with one of a user identifier (UID) or a group identifier (GID) of the read request;
identifying a subset of the data, based on the at least one permission, wherein identifying the subset of the data comprises application of a filter to metadata associated with the subset of data to generate the filtered view;
providing the filtered view comprising the subset of the data;
receiving a modification to the subset of the data provided via the filtered view; and
replicating the modification in the data stored in the memory.

8. The method of claim 7 , wherein the data corresponds to at least one object stored in the memory, and wherein the at least one permission is associated on a per data portion of an object basis.

9. The method of claim 7 , wherein the data corresponds to at least one bucket stored in the memory, and wherein the at least one permission is associated on a per object basis.

10. The method of claim 7 , wherein the data corresponds to at least one directory stored in the memory, and wherein the at least one permission is associated on a per subdirectory or per file basis.

11. The method of claim 7 , wherein the data corresponds to at least one file stored in the memory, and wherein the at least one permission is associated on a per data portion of a file basis.

12. The method of claim 7 , wherein the filtered view reflects a modification to the subset of the data made in another view of the data.

13. A tangible, non-transient, computer readable media having instructions thereupon which, when performed by a processing device, cause the processing device to:
receive a read request for a filtered view of data in a memory, the read request associated with at least one permission for viewing the data;
identify an entity associated with the read request, wherein the at least one permission for viewing the data is based on the entity associated with the read request and a tag of the data associated with one of a user identifier (UID) or a group identifier (GID);
identify a subset of the data, based on the at least one permission, wherein identifying the subset of the data comprises application of a filter to metadata associated with the subset of data to generate the filtered view; and
provide the filtered view comprising the subset of the data;
receive a modification to the subset of the data provided via the filtered view; and
replicate the modification in the data stored in the memory.

14. The computer readable media of claim 13 , wherein the data corresponds to at least one object stored in the memory, and wherein the at least one permission is associated on a per data portion of an object basis.

15. The computer readable media of claim 13 , wherein the data corresponds to at least one bucket stored in the memory, and wherein the at least one permission is associated on a per object basis.

16. The computer readable media of claim 13 , wherein the data corresponds to at least one file stored in the memory, and wherein the at least one permission is associated on a per data portion of a file basis.

17. The computer readable media of claim 13 , wherein the read request comprises an application protocol interface (API) command that causes the processing device to generate the filtered view of the data associated with the read request.

Assignees

• Pure Storage Inc

Inventors

• Lee Robert
• Colgrove John
• Choudhury Bikash Roy
• Arora Mandeep
• Child Roy
• Narayanaswamy Purvaja
• Sandvig Cary A

Classifications

• G06F3/0622 Primary

  in relation to access · CPC title

• G06F3/0604

  Improving or facilitating administration, e.g. storage management · CPC title

• G06F3/0653

  Monitoring storage devices or systems · CPC title

• G06F3/0659

  Command handling arrangements, e.g. command buffers, queues, command scheduling · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title