File access control in a multi-protocol file server

Abstract

The invention provides a method and system for enforcing file access control among client devices using multiple diverse access control models and multiple diverse file server protocols. A multi-protocol file server identifies each file with one particular access control model out of a plurality of possible models, and enforces that one particular model for all accesses to that file. When the file server receives a file server request for that file using a different access control model, the file server translates the access control limits for that file into no-less-restrictive limits in the different model. The file server restricts access by the client device using the translated access control limits. Each file is assigned the access control model of the user who created the file or who last set access control limits for the file. When a user having a different access control model sets access control limits, the access control model for the file is changed to the new model. Files are organized in a tree hierarchy, in which each tree is limited to one or more access control models (which can limit the ability of users to set access control limits for files in that tree). Each tree can be limited to NT-model-only format, Unix-model-only format, or mixed NT-or-Unix-models format.

Description

technical field [0001] The invention relates to file access control in a multi-protocol file server. Background technique [0002] In an integrated computer network, it is desirable for multiple client devices to share access to the same files. One well-known approach is to provide a network file server for storing files that receives and responds to file server requests from client devices. These file server requests are formed using a file server protocol that is recognizable by and belongs to both the file server and the client device. Since the files are stored in the file server, multiple client devices have the opportunity to share access to the same files. [0003] In a file system used by more than one user, it is desirable to programmatically restrict access to files in the file system. Restricting access includes at least the following: (1) user authentication—determining that requesting users are who they say they are; and (2) access control verification—determ...

AI Technical Summary

Problems solved by technology

This known method has the drawback that the user's access control scheme differs significantly from the set of access control schemes used for the file, thereby causing security issues for those client devices using security semantics other than those associated with the target file. mistakes and accidents

Images