# US 2025/0165641 A1 · Management of Access Control Lists for a Storage System > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0165641 A1 - Document ID: US20250165641A1 - Status: Published application - Kind: A1 - Application number: 19/029,727 - Filed: 2025-01-17 - Published: 2025-05-22 - Earliest claimed: 2021-01-12 - Assignees: Pure Storage, Inc. - Applicants: Pure Storage, Inc. - Inventors: Purvaja Narayanaswamy; Yi Li; Weitao Wen - Web page: https://patentgrep.com/patent/US20250165641A1 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 16/137: {Hash-based (content-based indexing of textual data G06F16/31)} - G06F 16/148: {File search processing} - G06F 16/172: Caching, prefetching or hoarding of files - G06F 16/1774: {Locking methods, e.g. locking methods for file systems allowing shared and concurrent access to files} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An illustrative method includes an access control list (ACL) management system generating an ACL that describes one or more access permissions in a file system; generating an ACL identifier for the ACL; mapping, using the ACL identifier, the ACL to a plurality of data files in the file system to apply the ACL to the plurality of data files, the mapping the ACL comprising updating one or more metadata records for the plurality of data files; receiving a request associated with one or more of the plurality of data files; accessing, based on the request, the ACL identifier using the one or more metadata records for the plurality of data files; and accessing, using the ACL identifier, the ACL. ## Claims ### Claim 1 A method comprising: generating, by an access control list (ACL) management system, an ACL that describes one or more access permissions in a file system; generating, by the ACL management system, an ACL identifier for the ACL; mapping, by the ACL management system and using the ACL identifier, the ACL to a plurality of data files in the file system to apply the ACL to the plurality of data files, the mapping the ACL comprising updating one or more metadata records for the plurality of data files; receiving, by the ACL management system, a request associated with one or more of the plurality of data files; accessing, by the ACL management system based on the request, the ACL identifier using the one or more metadata records for the plurality of data files; and accessing, by the ACL management system using the ACL identifier, the ACL. ### Claim 2 (depends on 1) The method of claim 1, further comprising: computing, by the ACL management system, a value corresponding to the ACL; and storing, by the ACL management system, data representative of the ACL based on the value. ### Claim 3 (depends on 2) The method of claim 2, wherein the value comprises a hash value computed for the ACL using a hash function. ### Claim 4 (depends on 2) The method of claim 2, wherein the value is stored in a metadata record associated with the ACL. ### Claim 5 (depends on 1) The method of claim 1, further comprising: caching the accessed ACL as a cache entry in a cache; receiving an additional request associated with one or more of the plurality of data files; accessing, based on the additional request, the ACL from the cache entry in the cache. ### Claim 6 (depends on 5) The method of claim 5, wherein the ACL is accessed from the cache, in response to the additional request, without retrieving the one or more metadata records for the plurality of data files or a metadata record for the ACL. ### Claim 7 (depends on 5) The method of claim 5, further comprising: detecting a change to an access permission applied to a data file included in the plurality of data files; remapping the data file to a different ACL. ### Claim 8 (depends on 7) The method of claim 7, further comprising: determining that the data file has been remapped to the different ACL; updating the cache entry based on the different ACL. ### Claim 9 (depends on 1) The method of claim 1, further comprising: receiving a request to provide a number of data files mapped to the ACL; determining a number of the plurality of data files that have the ACL identifier in the metadata records of the plurality of data files. ### Claim 10 (depends on 1) The method of claim 1, further comprising: receiving, an ACL management request to block access to the plurality of data files that are mapped to the ACL; disabling the ACL in response to the ACL management request. ### Claim 11 A system comprising: a memory storing instructions; a processor communicatively coupled to the memory and configured to execute the instructions to: generate an ACL identifier for the ACL; map, using the ACL identifier, the ACL to a plurality of data files in the file system to apply the ACL to the plurality of data files, the mapping the ACL comprising updating one or more metadata records for the plurality of data files; receive a request associated with one or more of the plurality of data files; accessing, based on the request, the ACL identifier using the one or more metadata records for the plurality of data files; and using the ACL identifier to access the ACL. ### Claim 12 (depends on 11) The system of claim 11, wherein the processor is further configured to execute the instructions to: compute a value corresponding to the ACL; and store data representative of the ACL based on the value. ### Claim 13 (depends on 12) The system of claim 12, wherein the data representative of the ACL is stored in a directory structure based on the value. ### Claim 14 (depends on 12) The system of claim 12, wherein the value comprises a hash value stored in a metadata record associated with the ACL. ### Claim 15 (depends on 11) The system of claim 11, wherein the processor is further configured to execute the instructions to: cache the accessed ACL as a cache entry in a cache; receive an additional request associated with one or more of the plurality of data files; access, based on the additional request, the ACL from the cache entry in the cache. ### Claim 16 (depends on 11) The system of claim 11, wherein the processor is further configured to execute the instructions to: detect a change to an access permission applied to a data file included in the plurality of data files; remap the data file to a different ACL. ### Claim 17 (depends on 11) The system of claim 11, wherein the processor is further configured to execute the instructions to: receive a request to count how many data files are mapped to the ACL; determine a number of the plurality of data files that have the ACL identifier in the metadata records of the plurality of data files. ### Claim 18 A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for: generating an ACL that describes one or more access permissions in a file system; generating an ACL identifier for the ACL; mapping, using the ACL identifier, the ACL to a plurality of data files in the file system to apply the ACL to the plurality of data files, the mapping the ACL comprising updating one or more metadata records for the plurality of data files; receiving a request associated with one or more of the plurality of data files; accessing, based on the request, the ACL identifier using the one or more metadata records for the plurality of data files; and accessing, using the ACL identifier, the ACL. ### Claim 19 (depends on 18) The computer program product of claim 18, further comprising computer instructions for: caching the accessed ACL as a cache entry in a cache; receiving an additional request associated with one or more of the plurality of data files; accessing, based on the additional request, the ACL from the cache entry in the cache. ### Claim 20 (depends on 19) The computer program product of claim 19, wherein the ACL is accessed from the cache, in response to the additional request, without retrieving the one or more metadata records for the plurality of data files or a metadata record for the ACL.