Storage system and file access determination method of the same
AssigneeHitachi, Ltd.
InventorsTakaki Nakamura, Hitoshi Kamei
Life of this patent
Estimating the term…
Abstract
A storage system configured to be applied to a broad range of access forms to the file and improve performance of file access control processing. The storage system may store a part of the access control information of a variable size in the basic attribute area of the file, and store the storage format information in the basic attribute area of the file or in the file system metadata area. At the time of processing the access to the file, with reference to the storage format information, the storage system may decode a part of the access control information into an access mask bit string as needed, and perform the preceding access control processing.
Claims12
A storage system, comprising:
- a storage device in which a file system is created;
- and
- a file access controller for determining an executability of an access request to a file based on access control information showing whether access to a file stored in the file system is permitted,
- wherein the file is configured from a data area, a basic attribute area, and an extended attribute area,
- wherein the access control information comprises:
- second access control information stored in the extended attribute area of the file as a variable length area,
- the second access control information including a plurality of information of access rights showing a type of a plurality of access requests to be permitted or rejected for each user or group that executes the access request to the file;
- and
- first access control information stored in the basic attribute area of the file as a fixed length area,
- the first access control information being at least a partial information of the access right included in the second access control information, and
- the first access control information showing one or more types of the access requests to be permitted or rejected for the user or the group,
- wherein the file access controller is configured to:
- (A) execute, upon receiving the access request to the file, a first determination processing of determining whether access to the file is permitted by using the first access control information stored in the basic attribute area of the file, wherein the first access control information includes said information converted from the information of the access right included in the second access control information;
- and
- (B) execute a second determination processing of determining whether the access to the file is permitted based on the second access control information stored in the extended attribute area of the file when the storage system cannot determine via the first determining processing whether access to the file is permitted.
A file access determination method in which a file access controller determines whether access to a file stored in a file system created in a storage device is permitted based on access control information, comprising the steps of:
- storing second access control information, including a plurality of information of access rights showing a type of a plurality of access requests to be permitted or rejected for each user or group that executes the access request to the file in an extended attribute area of the file as a variable length area;
- creating first access control information wherein the first access control information is at least a partial information of the access right included in the second access control information;
- and the first access control information is configured to show one or more types of the access requests to be permitted or rejected for the user or the group;
- storing the created first access control information in a basic attribute area of the file as a fixed length area;
- upon receiving the access request to the file, executing first determination processing of determining whether access to the file is permitted by using the first access control information stored in the basic attribute area of the file;
- wherein the first access control information includes said information converted from the information of the access right included in the second access control information;
- and
- executing a second determination processing of determining whether the access to the file is permitted based on the second access control information stored in the extended attribute area of the file when the storage system cannot determine via the first determining processing whether access to the file is permitted.
Dependencies are inferred from the claim text.