Access control list (ACL) and role-based access control (RBAC) management using content-based datasets

1 . A computer-implemented method of providing content-based access security in a data processing system, comprising:

accessing content data in a dataset comprising data objects having disparate file formats and protected by different protection policies;

iteratively processing the content data to tag the data objects according to a native file format;

attaching multiple tags to the dataset to indicate that the data objects of the dataset are of different file types according to the disparate file formats;

merging the protection policies to protect the dataset under a merged protection policy utilizing a most restrictive policy of the different protection policies;

defining a protection policy of the merged protection policy as composed of one or more queries representing data to be protected by a backup server of the data processing system to commonly protect selected data stored in different storage devices and network environments according to a corresponding native file format, the selected data having corresponding metadata, wherein the metadata comprises information describing the selected data through one or more characteristics to establish a unique data identifier for corresponding content data;

storing the metadata in a scanning data catalog comprising pointers to content data;

receiving, in a search engine, a query of the one or more queries to retrieve content data referenced by corresponding metadata and responsive to the query, wherein the query comprises a textual input containing one or more keywords;

applying the query to the scanning data catalog to generate the dataset that automatically tracks data added, removed or relocated to content data protected by the protection policy;

grouping metadata for unstructured data objects of retrieved content data spanning multiple storage devices of different storage types by one or more filters, wherein the protection policy protects the selected data as a single unit based on data content rather than data location;

scanning the retrieved content data to identify metadata associated with data elements to be protected by a common access rule comprising at least one of an Access Control List (ACL) rule or a Role-Based Access Control (RBAC) rule that denies or blocks access to a data element or directory containing data elements to one or more persons or groups in the system; and

applying the common access rule to the dataset to associate the common access rule to the protection policy for each data element referenced by the dataset to protect the dataset based on data content as well as access rules.

2 . The method of claim 1 wherein the ACL comprises a list of permissions associated with certain data elements that specifies specific users or system processes that are allowed to operate on the certain data elements, and wherein the Role-Based Access Control (RBAC) rules allow or deny access on the basis of role-permissions or user-role and role-role relationships defined within the system.

3 . The method of claim 2 wherein one or more of the data elements of the scanned content data are associated with prior hierarchical access rules, and wherein the common access rule applied by the dataset supersedes inherited prior hierarchical access rules according to a defined priority policy.

4 . The method of claim 3 wherein a rule to block access supersedes a rule to allow access by any user or role to a data element covered by two or more hierarchical or dataset applied access rule.

5 . The method of claim 2 wherein the dataset spans multiple storage devices of different storage types, and wherein the dataset defines a single data access unit for the referenced data elements from the database, and further wherein the access rule controls access to the referenced data elements as the single unit based on data content rather than data location, and wherein the data elements comprise at least one of: object data, documents, files, directories, or filesystems.

6 . The method of claim 5 wherein the multiple storage devices comprise network attached storage (NAS), object storage, local storage, or cloud networks, and wherein the dataset automatically tracks data added, removed or relocated to a body of data protected by the defined protection policy and the access rules.

7 . The method of claim 6 wherein the multiple storage devices further comprise data storage deployed in different network environments including core networks, edge networks, and cloud networks.

8 . The method of claim 1 wherein the query comprises metadata selectors as tags for matching against the identified metadata, and wherein the metadata selectors comprise tags consisting of alphanumeric strings applied to respective data objects based on user-defined rules, and wherein the tags define at least one of a file type, name, location, creation time, or characteristic.

9 . The method of claim 1 wherein the dataset is one of a static dataset or a dynamic dataset, wherein the static dataset comprises a fixed amount of data set at a time of creation, and the dynamic dataset comprises an amount of data that changes over time.

10 . A computer-implemented method of applying user access rules to data stored among multiple storage device types in a data processing environment based on data content rather than data location, comprising:

accessing content data in a dataset comprising data objects having disparate file formats and protected by different protection policies;

iteratively processing the content data to tag the data objects according to a native file format;

attaching multiple tags to the dataset to indicate that the data objects of the dataset are of different file types according to the disparate file formats;

merging the protection policies to protect the dataset under a merged protection policy utilizing a most restrictive policy of the different protection policies;

defining a protection policy of the merged protection policy as composed of one or more queries representing data to be protected by a backup server of the data processing system to commonly protect selected data stored in different storage devices and network environments according to a corresponding native file format, the selected data having corresponding metadata, wherein the metadata comprises information describing the selected data through one or more characteristics to establish a unique data identifier for corresponding content data;

storing the metadata in a scanning data catalog comprising pointers to content data;

receiving, in a search engine, a query of the one or more queries to retrieve content data referenced by corresponding metadata and responsive to the query;

applying the query to the scanning data catalog to generate the dataset that automatically tracks data added, removed or relocated to content data protected by the protection policy;

grouping metadata for unstructured data objects spanning multiple storage devices of different storage types by one or more filters, wherein the protection policy protects the selected data as a single unit based on data content rather than data location;

defining an access rule to be applied to selected data, the access rule dictating allowing or denying an operation acting on the selected data by a user or process of the system, and comprising at least one of an Access Control List (ACL) rule or a Role-Based Access Control (RBAC) rule;

tagging the selected data with a defined metadata tag;

gathering the tagged data for storage in the data catalog; and

applying the defined user access rule to the defined protection policy for the dataset to perform a data protection application on the selected data based on data content as well as access rules.

11 . The method of claim 10 wherein the dataset uniquely references the selected data through the metadata tags identifying corresponding content data of the selected data, and wherein the tags comprise alphanumeric strings applied to respective data objects based on user-defined rules, and wherein the tags define at least one of a file type, name, location, creation time, or characteristic.

12 . The method of claim 11 wherein the ACL comprises a list of permissions associated with certain data elements that specifies specific users or system processes that are allowed to operate on the certain data elements, and wherein the Role-Based Access Control (RBAC) rules allow or deny access on the basis of role-permissions or user-role and role-role relationships defined within the system.

13 . The method of claim 12 wherein one or more of the data elements of the data objects are associated with prior hierarchical access rules, the method further comprising:

defining a priority policy dictating priority of access rules among conflicting prior hierarchical access rules and dataset assigned access rules; and

applying the priority policy to determine user access to the one or more data elements, and wherein the access rule applied by the dataset supersedes an inherited prior hierarchical access rules unless overridden by the defined priority policy, and further wherein a rule to block access supersedes a rule to allow access by any user or role to a data element covered by two or more hierarchical or dataset applied access rule.

14 . The method of claim 12 wherein the multiple storage device types comprise network attached storage (NAS), object storage, local storage, or cloud networks, and wherein the dataset automatically tracks data added, removed or relocated to a body of data protected by the defined access rule, and further wherein the multiple storage devices comprise data storage deployed in different network environments including core networks, edge networks, and cloud networks.