Accessing and providing access to computer files over a computer network

Patent metadata

Field	Value
Publication number	US-9892274-B2
Application number	US-201414555167-A
Country	US
Kind code	B2
Filing date	Nov 26, 2014
Priority date	Oct 25, 2010
Publication date	Feb 13, 2018
Grant date	Feb 13, 2018

Abstract

Methods, systems and computer program products are provided that may relate to controlling access to or accessing computer files over a computer network. A file server may execute on a first computer system and a client may execute on a second computer system. The client may be configured to send a first communication to the file server relating to a first computer file stored on the first computer system. The first communication may include first access control data associated with the first computer file. The file server may be configured to receive the first communication and extract the first access control data from the first communication. The file server may then store the extracted first access control data in extended attributes of the first computer file on the first computer system.

First claim

What is claimed is:

1. A system comprising:
a plurality of client computers;
a file server communicatively connected to the client computers and storing a plurality of computer files under a same user identifier in standard file attributes of the computer files, and storing access control data of the computer files in extended attributes of the computer files,
wherein each client computer stores thereon local copies of the computer files received from the file server by extracting the access control data thereof and storing the access control data in the standard file attributes of the computer files,
wherein the access control data of the computer files is provided by the client computers such that access to the computer files by the client computers is controlled by the client computers and not by the file server,
wherein the file server is to:
receive a first communication from a first client computer of the client computers relating to a given computer file of the computer files;
extract the access control data from the extended attributes of the given computer file;
generate a second communication containing the access control data; and
send the second communication to a second client computer of the client computers,

and wherein the second client computer is to:
receive the second communication;
extract the access control data from the second communication; and
permit access to the given computer file by the first client computer based on the access control data.

2. The system of claim 1 , wherein the file server executes as a user associated with the same user identifier.

3. The system of claim 1 , wherein the file server executes as an unprivileged process.

4. The system of claim 1 , wherein the file server is configured to:
create a regular computer file of the computer files corresponding to a special computer file;
store in the extended attributes of the regular computer file an indicator of a resource represented by the special computer file.

5. The system of claim 4 , wherein the resource represented by the special computer file is one of a device, a symbolic link and a socket.

6. The system of claim 4 , wherein the special computer file is treated by the file server as the regular computer file and by each client computer device as the special computer file.

7. The system of claim 6 , wherein the special computer file is a symbolic link, and the file server is configured to include in the regular computer file a target location of the symbolic link.

8. A computer program product for providing access to a plurality of computer files over a computer network including a plurality of client computers and a file server, the computer program product including a storage device storing computer-executable code executed by the file server to:
store the computer files under a same user identifier in standard file attributes of the computer files, and store access control data of the computer files in extended attributes of the computer files,
wherein each client computer stores thereon local copies of the computer files received from the file server by extracting the access control data thereof and storing the access control data in the standard file attributes of the computer files,
wherein the access control data of the computer files is provided by the client computers such that access to the computer files by the client computers is controlled by the client computers and not by the file server;
receive a first communication from a first client computer of the client computers relating to a given computer file of the computer files;
extract the access control data from the extended attributes of the given computer file;
generate a second communication containing the access control data; and
send the second communication to a second client computer of the client computers,
wherein the second client computer is to receive the second communication, extract the access control data from the second communication, permit access to the given computer file by the first client computer based on the access control data.

9. The computer program product of claim 8 , wherein the file server executes the computer-executable code as a user associated with the same user identifier.

10. The computer program product of claim 8 , wherein the file server executes the computer-executable code as an unprivileged process.

11. The computer program product of claim 8 , wherein the computer-executable code is further executed by the file server to:
create a regular computer file of the computer files corresponding to a special computer file;
store in the extended attributes of the regular computer file an indicator of a resource represented by the special computer file.

12. A computer program product for providing access to a plurality of computer files over a computer network including a plurality of client computers and a file server, the computer program product including a storage device storing computer-executable code executed by each client computer to:
store local copies of the computer files received from the file server by extracting access control data of the computer files and storing the access control data in standard file attributes of the computer files,
provide the access control data of the computer files such that access to the computer files by the client computers is controlled by the client computers and not by the file server,
wherein the file server stores the computer files under a same user identifier in the standard file attributes of the computer files, and stores the access control data of the computer files in extended attributes of the computer files;
wherein the file server receives a first communication from a first client computer of the client computers relating to a given computer file of the computer files, extracts the access control data from the extended attributes of the given computer file, generates a second communication containing the access control data, and sends the second communication to a second client computer of the client computers,
and wherein the second client computer is to receive the second communication, extract the access control data from the second communication, and permit access to the given computer file by the first client computer based on the access control data.

Assignees

• IBM

Inventors

• French Steven M
• Jujjuri Venkateswararao
• Liguori Anthony N
• Pulavarty Badari
• Van Hensbergen Eric V
• Veetil Aneesh K

Classifications

• G06F16/196

  Specific adaptations of the file system to access devices and non-file objects via standard file system access operations, e.g. pseudo file systems (dedicated interfaces to storage systems G06F3/0601) · CPC title

• G06F16/182

  Distributed file systems · CPC title

• G06F16/176

  Support for shared access to files; File sharing support · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F2213/0038

  System on Chip · CPC title