Short-Circuit Data Access
AssigneeBlueTalon, Inc.
InventorsDilli Dorai Minnal Arumugam, Prasad Mujumdar
Life of this patent
Estimating the term…
Abstract
A policy system enforces data security policies for requests from accessing data stored on a distributed data storage system received from a client device. The policy enforcement system can determine user credentials from the requests. The enforcement system then determines whether the user credentials allow the request to retrieve the data and if yes, whether the user credentials allow the request to retrieve the data without obligations. Upon determining that user credentials allow the request to retrieve the data without obligations, the policy enforcement system directs the client device to communicate directly with a name node of the data storage system, short-circuiting additional data retrieval and filtering of the policy system.
Claims20
A method, comprising:
- receiving, from a client device by a policy system, a request to access data stored one a distributed file system comprising a name node and one or more data nodes, the request comprising user credentials;
- determining, by a policy decision point of the policy system and according to one or more data access policies and the user credentials, whether the request is to be denied, to be allowed with obligations, or to be allowed without obligations;
- and
- in response to results of the determining, perform actions including:
- upon determining that the request is to be denied, notifying the client device of request denial by the policy system;
- upon determining that the request is to be allowed with obligations, requesting data from the distributed file system by the policy system;
- and
- upon determining that the request is to be allowed without obligations, redirecting the request to a short-circuit handler executing on the name node of the distributed file system, the short-circuit handler verifying with the policy decision point that the request is to be allowed without obligations and, upon verification, allowing the client device to access the requested data.
A system comprising:
- one or more processors;
- and
- a non-transitory computer-readable medium storing instructions that, upon execution by the one or more processors, cause the one or more processors to perform operations comprising:
- receiving, from a client device by a policy system, a request to access data stored one a distributed file system comprising a name node and one or more data nodes, the request comprising user credentials;
- determining, by a policy decision point of the policy system and according to one or more data access policies and the user credentials, whether the request is to be denied, to be allowed with obligations, or to be allowed without obligations;
- and
- in response to results of the determining, perform actions including:
- upon determining that the request is to be denied, notifying the client device of request denial by the policy system;
- upon determining that the request is to be allowed with obligations, requesting data from the distributed file system by the policy system;
- and
- upon determining that the request is to be allowed without obligations, redirecting the request to a short-circuit handler executing on the name node of the distributed file system, the short-circuit handler verifying with the policy decision point that the request is to be allowed without obligations and, upon verification, allowing the client device to access the requested data.
A non-transitory computer-readable medium storing instructions that, upon execution by one or more processors, cause the one or more processors to perform operations comprising:
- receiving a request to access data by a short-circuit handler executing on a name node of a distributed file system, the request being associated with user credentials;
- determining whether the request received by the short-circuit handler is received from a client device or from a policy system;
- in response to determining that the request is from a client device, communicating with a policy decision point of the policy system for verification of the user credentials;
- receiving a decision from the policy decision point on whether the request is to be denied, to be allowed with obligations, or to be allowed without obligations;
- and
- in response to the decision, performing actions including:
- upon determining that the request is to be denied or to be allowed with obligations, notifying the client device of a request denial;
- and
- upon determining that the request is to be allowed without obligations, allowing the client device to access the requested data.
Dependencies are inferred from the claim text.