Method, secure device, system and computer program product for securely managing user access to a file system

Patent metadata

Field	Value
Publication number	US-9760729-B2
Application number	US-201514724131-A
Country	US
Kind code	B2
Filing date	May 28, 2015
Priority date	Oct 29, 2010
Publication date	Sep 12, 2017
Grant date	Sep 12, 2017

Abstract

A method, a secure device, a system and a computer program product for securely managing user access to a file system. The method includes providing a secure device, where the secure device is protected by design against malicious software or malware and adapted to establish a connection to a server through a telecommunication network establishing a connection between the secure device and the server, receiving at the secure device, through the established connection, data pertaining to a file system identifying files which are at least partly stored outside the secure device, exposing at the secure device the file system to a user, based on the data received from the server, the file system navigable by the user.

First claim

The invention claimed is:

1. A method for securely managing user access to a file system, comprising:
providing a secure device comprising a Universal Serial Bus (USB) flash drive, wherein the secure device is adapted to establish a connection to a server;
establishing the connection between the secure device and the server using a secure sockets layer (SSL)/transport layer security (TLS) authentication;
receiving, at the secure device and through the established connection, a plurality of data pertaining to a virtual tree file system, wherein the virtual tree file system comprises a plurality of files which are stored outside the secure device;
processing the user request at the secure device according to an updated use permission associated to an internal file, wherein the updated use permission is obtained at the secure device by updating a use permission based on permission data sent from the server through a connection established between the secure device and the server;
exposing, at the secure device, the virtual tree file system to a user based on the data received from the server, wherein the virtual tree file system is navigable by the user;
receiving a request for accessing a file in the virtual tree file system; wherein the file is fetched externally to the secure device from the server via the server according to a server policy;
displaying to the user with a display of the secured device, the file in the virtual tree file system through the established connection, the file being presented on the display and not cached locally in the memory in the secured device; and
receiving, at the secure device and through the established connection, updated data pertaining to an updated virtual tree file system comprising a plurality of files which are at least partly stored outside the secure device and partly stored inside the secure device; and exposing, at the secure device, the updated virtual tree file system to the user based on the updated data received from the server; wherein the updated virtual tree file system is navigable by the user;

and wherein a file stored on a memory of the secure device, which is identified in a previously exposed file system and not identified in the updated file system, is removed from the memory of the secure device.

2. The method of claim 1 , further comprising: after receiving at the secure device, a request for accessing an external file identified in the exposed virtual tree file system and stored outside the secure device, receiving, at the secure device, an external file through a connection established between the secure device and the server for subsequent storage on the secure device.

3. The method of claim 1 , wherein the data pertaining to the virtual tree file system as received at the secure device and the corresponding virtual tree file system are user specific.

4. The method of claim 1 , wherein the step of receiving data further comprises receiving data corresponding to one or more files identified in the corresponding virtual tree file system.

5. The method of claim 1 wherein: the files identified in the virtual tree file system, as exposed at the secure device, are stored on a plurality of servers; and said virtual tree file system, as exposed, is seamlessly navigable by the user.

6. The method of claim 1 , further comprising: updating a use permission associated to the internal file upon granting the request for using the internal file.

7. The method of claim 6 , wherein updating a use permission associated to the internal file is carried out at the secure device.

8. The method of claim 6 , further comprising, after updating a use permission associated to the internal file, instructing, at the secure device, to expose the internal file to a user interface or an application according to said updated use permission.

9. The method of claim 1 , wherein an updated use permission comprises a parameter, and wherein the parameter restricts access rights to the file when interpreted by the device processing a request for using the file.

10. A secure device protected by design against malicious software or malware and adapted to establish a connection with a server when the secure device is connected to the server through a telecommunication network, the secure device comprising:
an interface communicatively coupled to said telecommunication network; a memory; and
a processing means communicatively coupled to the memory, wherein the processing means is configured to perform the steps of a method comprising:
establishing a connection between the secure device comprising a Universal Serial Bus (USB) flash drive and the server, wherein the secure device is adapted to establish the connection to the server using a secure sockets layer (SSL)/transport layer security (TLS) authentication, and to be a secure cache for the server;
receiving, at the secure device and through the established connection, a plurality of data pertaining to a virtual tree file system, processing the user request at the secure device according to an updated use permission associated to an internal file, wherein the updated use permission is obtained at the secure device by updating a use permission based on permission data sent from the server through a connection established between the secure device and the server, wherein the virtual tree file system comprises a plurality of files which are at least partly stored outside the secure device;
exposing, at the secure device, the virtual tree file system to a user based on the data received from the server, wherein the virtual tree file system is navigable by the user;
receiving a request for accessing a file in the virtual tree file system; wherein the file is fetched externally to the secure device from the server via the server according to a server policy;
displaying to the user with a display of the secured device, the file in the virtual tree file system through the established connection, the file being presented on the display and not cached locally in the memory in the secured device; and
receiving, at the secure device and through the established connection, updated data pertaining to an updated virtual tree file system comprising a plurality of files which are at least partly stored outside the secure device and partly stored inside the secure device; and exposing, at the secure device, the updated virtual tree file system to the user based on the updated data received from the server; wherein the updated virtual tree file system is navigable by the user; and wherein a file stored on a memory of the secure device, which is identified in a previously exposed file system and not identified in the updated file system, is removed from the memory of the secure device.

11. A system for securely managing user access to a file system, comprising:
a personal computer (PC);
an at least one server; and
a secure device comprising a Universal Serial Bus (USB) flash drive protected by design against malicious software or malware and adapted to establish a connection with the at least one server when the secure device is connected to the at least one server through a telecommunication network, the secure device comprising:
an interface communicatively coupled to said telecommunication network; a memory; and
a processing means communicatively coupled to the memory, wherein the processing means is configured to perform the steps of a method comprising:
establishing a connection between the secure device and the at least one server, wherein the secure device is adapted to establish the connection to a server using a secure sockets layer (SSL)/transport layer security (TLS) authentication, and to be a secure cache for th

Assignees

• IBM

Inventors

• Baentsch Michael
• Dykeman Harold D
• Hermann Reto J
• Kramp Thorsten
• Kuyper-Hammond Michael P
• Osborne Michael C
• Weigold Thomas D

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F2221/2153

  Using hardware token as a secondary aspect · CPC title