System and method for quickly accessing user permissions in an access control list
View Patent ↗A system for quickly accessing user permissions in an access control list includes a first cache memory ( 2 ), a second cache memory ( 3 ), a permission querying module ( 12 ), a permission merging module ( 13 ), and an information unit generating module ( 14 ). The first cache memory is for storing a plurality of first information units ( 20 ). The second cache memory is for storing a plurality of second information units ( 30 ). The permission querying module is for querying the user permissions stored in the first cache memory and the second cache memory, and respectively storing first information units and second information units in the first cache memory and the second cache memory. The permission merging module is for merging different user permissions. The information unit generating module is for generating the first information units and the second information units. A related method is also disclosed.
1. A system for quickly accessing user permissions in an access control list of a network attached storage server, comprising:
a first cache memory for storing a plurality of first information units, the first information units each storing data on a user permission of a latest accessed user;
a second cache memory for storing a plurality of second information units, the second information units storing semi-results of computing different user permissions and directory relations;
a permission querying module for querying the user permissions stored in the first cache memory and the second cache memory, and for respectively storing the first information units and the second information units in the first cache memory and the second cache memory;
a permission merging module for merging different user permissions; and
an information unit generating module for generating the first information units and the second information units.
2. The system as claimed in claim 1 , wherein each of the first information units comprises data on a unique user ID (identification code) U, a currently requested Permission ID I C , and an inherited Permission ID P I .
3. The system as claimed in claim 1 , wherein each of the second information units comprises data on a unique user ID U, a latest Permission ID I L , a currently requested Permission ID I C , and a current computed Permission ID P C .
4. The system as claimed in claim 1 , wherein a capacity of the second cache memory is 64 KB (kilobytes).
5. The system as claimed in claim 1 , wherein the second cache memory can store 16 semi-results at one time.
6. The system as claimed in claim 1 , further comprising a directory managing module for managing a directory of the documents stored in the network attached storage server, such management comprising reading, writing, deleting, and modifying the documents.
7. The system as claimed in claim 1 , further comprising a permission computing module for computing a value of a Permission P C of a current accessing target, the target comprising a document or a directory.
8. The system as claimed in claim 2 , wherein the permission merging module merges the inherited Permission ID P I with the current computed Permission ID P C .
9. The system as claimed in claim 3 , wherein the permission merging module merges the inherited Permission ID P I with the current computed Permission ID P C .
10. A method for quickly accessing user permissions in an access control list of a network attached storage server, the method comprising the steps of:
generating a dummy node in a root directory of the network attached storage server, the dummy node being a dummy user Permission ID;
adding a first information unit to a first cache memory, the first information unit storing data on a user permission of a latest accessed user;
querying a latest Permission ID I L and a currently requested Permission ID I C in a second cache memory, in accordance with a unique user ID U and a current computed Permission ID P C ;
determining whether the latest Permission ID I L and the currently requested Permission ID I C are found;
generating a first information unit if the required Permission ID is found; and
if no required Permission ID is found,
assigning an inherited Permission ID P I as being the result of merging the current computed Permission ID P C and the inherited Permission ID P I , and assigning a last current computed Permission ID P C ′ as being the current computed Permission ID P C ; and
determining whether a user process request is permitted.
11. The method as claimed in claim 10 , further comprising the step of:
adding a plurality of second information units to the second cache memory.
12. The method as claimed in claim 10 , wherein said merging is performed according to a list of rules on merging of permissions.
13. The method as claimed in claim 10 , wherein the dummy node is pre-set by an operating system, and comprises Permission FC(full control) for managers Permission RW(read write) for general users.