Method, secure device, system and computer program product for securely managing user access to a file system

Patent metadata

Field	Value
Publication number	US-9152815-B2
Application number	US-201113881735-A
Country	US
Kind code	B2
Filing date	Oct 18, 2011
Priority date	Oct 29, 2010
Publication date	Oct 6, 2015
Grant date	Oct 6, 2015

Abstract

A method, a secure device, a system and a computer program product for securely managing user access to a file system. The method includes providing a secure device, where the secure device is protected by design against malicious software or malware and adapted to establish a connection to a server through a telecommunication network establishing a connection between the secure device and the server, receiving at the secure device, through the established connection, data pertaining to a file system identifying files which are at least partly stored outside the secure device, exposing at the secure device the file system to a user, based on the data received from the server, the file system navigable by the user.

First claim

The invention claimed is:

1. A method for securely managing user access to a file system, comprising:
providing a secure device and a server, wherein the secure device becomes a secure cache for the server, wherein the secure device has a user security input, and wherein the server indicates if a particular document must not be cached in the secure device;
establishing a connection between the secure device and the server;
receiving, at the secure device and through the established connection, a plurality of data pertaining to a virtual tree file system, wherein the virtual tree file system identifies a plurality of files which are at least partly stored outside the secure device and partly stored inside the secure device;
exposing, at the secure device, the virtual tree file system to the user, based on the data received from the server, wherein the virtual tree file system is navigable by the user;
receiving a request for accessing a file in the virtual tree file system, wherein the file is encrypted according to a unique key;
processing the request according to a use permission associated to the file; and
after receiving a request for using an internal file identified in the exposed virtual tree file system and stored on the secure device, processing the user request at the secure device according to an updated use permission associated to the internal file, wherein the updated use permission is obtained at the secure device by updating a use permission based on permission data sent from the server through a connection established between the secure device and the server.

2. The method of claim 1 , further comprising:
after receiving, at the secure device, a request for accessing an external file identified in the exposed virtual tree file system and stored outside the secure device, receiving, at the secure device, an external file through a connection established between the secure device and the server for subsequent storage on the secure device.

3. The method of claim 1 , further comprising:
receiving, at the secure device and through the established connection, updated data pertaining to an updated virtual tree file system identifying files which are at least partly stored outside the secure device and partly stored inside the secure device;
exposing, at the secure device, the updated virtual tree file system to the user, based on the updated data received from the server:
wherein the updated virtual tree file system is navigable by the user; and
wherein a file stored on a memory of the secure device, which is identified in a previously exposed virtual tree file system and not identified in the updated virtual tree file system, is removed from the memory of the secure device.

4. The method of claim 1 , wherein the data pertaining to the virtual tree file system as received at the secure device and the corresponding virtual tree file system are user specific.

5. The method of claim 1 , wherein receiving data further comprises receiving data corresponding to one or more files identified in the corresponding virtual tree file system.

6. The method of claim 1 :
wherein the files identified in the virtual tree file system, as exposed at the secure device, are stored on a plurality of servers; and
said virtual tree file system, as exposed, being seamlessly navigable by the user.

7. The method of claim 1 , further comprising:
updating a use permission associated to the internal file upon granting the request for using the internal file.

8. The method of claim 7 , wherein updating a use permission associated to the internal file is carried out at the secure device.

9. The method of claim 7 , further comprising, after updating a use permission associated to the internal file, instructing, at the secure device, to expose the internal file to a user interface or an application, according to said updated use permission.

10. The method of claim 1 , wherein an updated use permission comprises a parameter, such as the number of times that the associated file can be accessed or the time during which it can be accessed, which parameter restricts access rights to the file when interpreted by the device processing a request for using the file.

11. The method of claim 1 , wherein a connection established between the secure device and the server is an SSL/TLS connection.

12. A secure device protected by design against malicious software or malware and adapted to establish a connection with a server when the secure device is connected to the server through a telecommunication network, the secure device comprising:
a plurality of interfaces communicatively coupled to said telecommunication network;
a memory; and
a processing means communicatively coupled to the memory, wherein the processing means is configured to perform the steps of a method comprising:
establishing a connection between the secure device and the server, wherein the secure device becomes a secure cache for the server, wherein the secure device has a user security input, and wherein the server indicates if a particular document must not be cached in the secure device;
receiving, at the secure device and through the established connection, a plurality of data pertaining to a virtual tree file system, wherein the virtual tree file system identifies a plurality of files which are at least partly stored outside the secure device and partly stored inside the secure device;
exposing, at the secure device, the virtual tree file system to the user, based on the data received from the server, wherein the virtual tree file system is navigable by the user;
receiving a request for accessing a file in the virtual tree file system, wherein the file is encrypted according to a unique key;
processing the request according to a use permission associated to the file; and
after receiving a request for using an internal file identified in the exposed virtual tree file system and stored on the secure device, processing the user request at the secure device according to an updated use permission associated to the internal file, wherein the updated use permission is obtained at the secure device by updating a use permission based on permission data sent from the server through a connection established between the secure device and the server.

13. A system for securely managing user access to a file system, the system comprising:
a personal computer;
an at least one servers; and
a secure device protected by design against malicious software or malware and adapted to establish a connection with the at least one server when the secure device is connected to the at least one server through a telecommunication network, the secure device comprising:
a plurality of interfaces communicatively coupled to said telecommunication network;
a memory; and
a processing means communicatively coupled to the memory, wherein the processing means is configured to perform the steps of a method comprising:
establishing a connection between the secure device and the at least one server, wherein the secure device becomes a secure cache for the at least one server, wherein the secure device has a user security input, and wherein the server indicates if a particular document must not be cached in the secure device;
receiving, at the secure device and through the established connection, a plurality of data pertaining to a virtual tree file system, wherein the virtual tree file system identifies a plurality of files which are at least partly stored outside the secure device and partly stored inside the secure device;
exposing, at the secure device, the virtual tree file system to the user, based on the data received fr

Assignees

• Baentsch Michael
• Dykeman Harold D
• Hermann Reto J
• Kramp Thorsten
• Kuyper-Hammond Michael P
• Osborne Michael C
• Weigold Thomas D
• IBM

Inventors

• Baentsch Michael
• Dykeman Harold D
• Hermann Reto J
• Kramp Thorsten
• Kuyper-Hammond Michael P
• Osborne Michael C
• Weigold Thomas D

Classifications

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F2221/2153

  Using hardware token as a secondary aspect · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title