# US 11,443,054 B2 · Referenced access control list

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,443,054 B2
- Document ID: US11443054B2
- Status: Granted
- Kind: B2
- Application number: 16/884,876
- Filed: 2020-05-27
- Published: 2020-09-10
- Granted: 2022-09-13
- Earliest claimed: 2017-04-21
- Assignees: Google Inc.
- Applicants: Google LLC
- Inventors: Vaibhav Mehta; Abhinav Khandelwal
- Web page: https://patentgrep.com/patent/US11443054B2

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 16/185: Hierarchical storage management [HSM] systems, e.g. file migration or policies thereof (details of archiving G06F16/11)
- G06F 16/9027: {Trees}
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- H04L 63/101: {Access control lists [ACL]}
- G06F 16/23: Updating
- G06F 2221/2145: Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for referenced access control lists. In one aspect, a method includes accessing an object hierarchy for a plurality of objects, each object being representative of one of a storage location or a file. The object hierarchy includes for each object, a respective node, for each object that is a parent object having a child object, a directed edge connecting the node representing the parent object. In addition, for each object, including metadata that includes an access control list identifier that identifies an access control list for the object and that is owned by an access control list root object. The method including receiving updates to an access control list for particular objects, generating a new access control list, and storing the new access control list identifier in metadata for each object that descends from the particular object.

## Claims

### Claim 1

A method performed by data processing apparatus, the method comprising:
accessing an object hierarchy for a plurality of objects, each object being representative of one of a storage location or a file, wherein each storage location may store one or more subordinate storage locations or files, wherein the hierarchy comprises:
for each object, a respective node;
for each object that is a parent object having a child object, a directed edge connecting the node representing the parent object to the node representing the child object;
wherein at least one object is represented by a root object, and at least one object is represented by a leaf object; and
for each object that is not an access control list root object, wherein an access control list root object is an object for which an access control list is owned by the object:
metadata that includes an access control list identifier that identifies an access control list for the object and that is owned by an access control list root object;
receiving updates to an access control list for particular objects, and determining, for each update, whether the particular object is an access control list root object;
for each update for a particular object not determined to be an access control list root object:
generating a new access control list based on the update and the access control list referenced by the access control list identifier for the node and setting ownership of the new access control list to the particular object to cause the particular object to become an access control list root object;
generating a new access control list identifier that identifies the new access control list;
storing the new access control list identifier in metadata for each object that descends from the particular object and that inherits the access control list from the particular object; and
storing the new access control list identifier as a divergent object in the access control list root object that the particular object descended from to indicate that updates to the access control list for the access control list root object are to be propagated to the new access control list identified by the new access control list identifier;
for each update for a particular object determined to be an access control list root object:
updating the access control list owned by the access control list root object, wherein the updated access control list is identified by the access control list identifier;
for each access control list identifier stored as a divergent object in the access control list root object, updating the access control list identified by the access control list identifier stored as the divergent object;
generating, for a first update request for an update to an access control list of a child object that references an access control list of an access control list root object by use of an access control list identifier, an asynchronous task event that specifies particular operations included in the update to the access control list of the child object;
generating, for the access control list of the access control list root object, a conflicting access control list update that specifies that the access control list of the child object has started to diverge;
in response to a second update request for an update to the access control list of the child object, wherein the second update request is received after the first update request and before an update specified by the first update request is completed, and based on the conflicting access control list update that specifies that the access control list of the child object has started to diverge:
precluding performance of the update specified by the second update request until the update specified by the first update request is completed;
after the update specified by the first update request is completed:
removing the second update request from the conflicting access control list;
determining whether the second update request is allowable; and
performing the update specified by the second update request only if the second update request is allowable.

### Claim 2 (depends on 1)

The method of claim 1, wherein the second update request is a request to remove an access capability of a user.

### Claim 3 (depends on 1)

The method of claim 1, wherein an update for a particular object comprises designating read and write access to either one of a storage location or a file.

### Claim 4 (depends on 1)

The method of any of claim 1, further comprising:
receiving a request to generate a new object within the object hierarchy;
for each new object that it is determined that the object will have only one parent object, assigning to the new object the access control list identifier of the parent object; and
for each new object that it is determined that the object will have more from one parent object:
creating an access control list and an access control list identifier specific to the new object; and
storing, at the node corresponding to the new object, the access control list and the access control list identifier.

### Claim 5

A system, comprising:
data processing apparatus; and
a non-transitory computer readable storage medium in data communication with the data processing apparatus and storing instructions executable by the data processing apparatus and upon such execution cause the data processing apparatus to perform operations comprising:
accessing an object hierarchy for a plurality of objects, each object being representative of one of a storage location or a file, wherein each storage location may store one or more subordinate storage locations or files, wherein the hierarchy comprises:
for each object, a respective node;
for each object that is a parent object having a child object, a directed edge connecting the node representing the parent object to the node representing the child object;
wherein at least one object is represented by a root object, and at least one object is represented by a leaf object; and
for each object that is not an access control list root object, wherein an access control list root object is an object for which an access control list is owned by the object: metadata that includes an access control list identifier that identifies an access control list for the object and that is owned by an access control list root object;
receiving updates to an access control list for particular objects, and determining, for each update, whether the particular object is an access control list root object;
for each update for a particular object not determined to be an access control list root object:
generating a new access control list based on the update and the access control list referenced by the access control list identifier for the node and setting ownership of the new access control list to the particular object to cause the particular object to become an access control list root object;
generating a new access control list identifier that identifies the new access control list;
storing the new access control list identifier in metadata for each object that descends from the particular object and that inherits the access control list from the particular object; and
storing the new access control list identifier as a divergent object in the access control list root object that the particular object descended from to indicate that updates to the access control list for the access control list root object are to be propagated to the new access control list identified by the new access control list identifier;
for each update for a particular object determined to be an access control list root object:
updating the access control list owned by the access control list root object, wherein the updated access control list is identified by the access control list identifier;
for each access control list identifier stored as a divergent object in the access control list root object, updating the access control list identified by the access control list identifier stored as the divergent object;
generating, for a first update request for an update to an access control list of a child object that references an access control list of an access control list root object by use of an access control list identifier, an asynchronous task event that specifies particular operations included in the update to the access control list of the child object;
generating, for the access control list of the access control list root object, a conflicting access control list update that specifies that the access control list of the child object has started to diverge;
in response to a second update request for an update to the access control list of the child object, wherein the second update request is received after the first update request and before an update specified by the first update request is completed, and based on the conflicting access control list update that specifies that the access control list of the child object has started to diverge:
precluding performance of the update specified by the second update request until the update specified by the first update request is completed;
after the update specified by the first update request is completed:
removing the second update request from the conflicting access control list;
determining whether the second update request is allowable; and
performing the update specified by the second update request only if the second update request is allowable.

### Claim 6 (depends on 5)

The system of claim 5, wherein the second update request is a request to remove an access capability of a user.

### Claim 7 (depends on 5)

The system of claim 5, wherein an update for a particular object comprises designating read and write access to either one of a storage location or a file.

### Claim 8 (depends on 5)

The system of claim 5, the operations further comprising:
receiving a request to generate a new object within the object hierarchy;
for each new object that it is determined that the object will have only one parent object, assigning to the new object the access control list identifier of the parent object; and
for each new object that it is determined that the object will have more from one parent object:
creating an access control list and an access control list identifier specific to the new object; and
storing, at the node corresponding to the new object, the access control list and the access control list identifier.

### Claim 9

A non-transitory computer readable storage medium storing instructions executable by a user device and upon such execution cause the user device to perform operations comprising:
accessing an object hierarchy for a plurality of objects, each object being representative of one of a storage location or a file, wherein each storage location may store one or more subordinate storage locations or files, wherein the hierarchy comprises:
for each object, a respective node;
for each object that is a parent object having a child object, a directed edge connecting the node representing the parent object to the node representing the child object;
wherein at least one object is represented by a root object, and at least one object is represented by a leaf object; and
for each object that is not an access control list root object, wherein an access control list root object is an object for which an access control list is owned by the object: metadata that includes an access control list identifier that identifies an access control list for the object and that is owned by an access control list root object;
receiving updates to an access control list for particular objects, and determining, for each update, whether the particular object is an access control list root object;
for each update for a particular object not determined to be an access control list root object:
generating a new access control list based on the update and the access control list referenced by the access control list identifier for the node and setting ownership of the new access control list to the particular object to cause the particular object to become an access control list root object;
generating a new access control list identifier that identifies the new access control list;
storing the new access control list identifier in metadata for each object that descends from the particular object and that inherits the access control list from the particular object; and
storing the new access control list identifier as a divergent object in the access control list root object that the particular object descended from to indicate that updates to the access control list for the access control list root object are to be propagated to the new access control list identified by the new access control list identifier;
for each update for a particular object determined to be an access control list root object:
updating the access control list owned by the access control list root object, wherein the updated access control list is identified by the access control list identifier;
for each access control list identifier stored as a divergent object in the access control list root object, updating the access control list identified by the access control list identifier stored as the divergent object;
generating, for a first update request for an update to an access control list of a child object that references an access control list of an access control list root object by use of an access control list identifier, an asynchronous task event that specifies particular operations included in the update to the access control list of the child object;
generating, for the access control list of the access control list root object, a conflicting access control list update that specifies that the access control list of the child object has started to diverge;
in response to a second update request for an update to the access control list of the child object, wherein the second update request is received after the first update request and before an update specified by the first update request is completed, and based on the conflicting access control list update that specifies that the access control list of the child object has started to diverge:
precluding performance of the update specified by the second update request until the update specified by the first update request is completed;
after the update specified by the first update request is completed:
removing the second update request from the conflicting access control list;
determining whether the second update request is allowable; and
performing the update specified by the second update request only if the second update request is allowable.

### Claim 10 (depends on 9)

The non-transitory computer readable storage medium of claim 9, wherein the second update request is a request to remove an access capability of a user.

### Claim 11 (depends on 9)

The non-transitory computer readable storage medium of claim 9, wherein an update for a particular object comprises designating read and write access to either one of a storage location or a file.

### Claim 12 (depends on 9)

The non-transitory computer readable storage medium of claim 9 the operations further comprising:
receiving a request to generate a new object within the object hierarchy;
for each new object that it is determined that the object will have only one parent object, assigning to the new object the access control list identifier of the parent object; and
for each new object that it is determined that the object will have more from one parent object:
creating an access control list and an access control list identifier specific to the new object; and
storing, at the node corresponding to the new object, the access control list and the access control list identifier.