Granted Patent B2

US 8,955,103 · App. 13/734,843 · Granted Feb 10, 2015

Abstract

Claims (51)

1. A system comprising:

a processor-implemented, cloud-based server node configured to:

receive a request from a processor-implemented client node external to a local network of the server node to access data in a share associated with the server node, the share comprising one or more data files;

receive a communication from a processor-implemented management nexus, the communication including a confirmation of an identity of the client node and a confirmation of an authorization for the client node to access the data in the share associated with the server node, the communication further including an identifier of a relay session established between a relay server and the client node by the management nexus, wherein the management nexus maintains a shares database identifying a plurality of available shares and an access control list associated with the available shares for each relay session, and wherein the management nexus maintains key management between the cloud-based server node and the client node; and

responsive to receiving the communication from the management nexus, send the client node the data in the share associated with the server node via the identified relay session without sending the data to the management nexus.

2. The system of claim 1 , wherein the processor-implemented server node is further configured to:

receive a client certificate from the client node; and

send a request to the management nexus to verify a status of the client certificate;

wherein the confirmation of the authorization for the client node to access the data in the share associated with the server node is based on the verification of the status of the client certificate by the management nexus; and

wherein sending the data in the share associated with the server node to the client node includes establishing a secure communication channel with the identified relay server responsive to the verification of the status of the certificate by the management nexus.

3. A computer-implemented method comprising:

receiving at a cloud-based server node, a request from a client node external to a local network of the server node to access data in a share associated with the server node, the share comprising one or more data files;

receiving a communication from a management nexus, the communication including a confirmation of an identity of the client node and a confirmation of an authorization for the client node to access the data in the share associated with the server node, the communication further including an identifier of a relay session established between a relay server and the client node by the management nexus, wherein the management nexus maintains a shares database identifying a plurality of available shares and an access control list associated with the available shares for each relay session, and wherein the management nexus maintains key management between the cloud-based server node and the client node; and

transmitting the data in the share associated with the server node from the server node to the client node via the identified relay session without sending the data to the management nexus.

4. The method of claim 3 , further comprising:

receiving a client certificate from the client node; and

sending a request to the management nexus to verify a status of the client certificate;

wherein the confirmation of the authorization for the client node to access the data in the share associated with the server node is based on the verification of the status of the client certificate by the management nexus; and

wherein transmitting the data in the share associated with the server node includes establishing a secure communication channel between the server node and the identified relay server responsive to the verification of the status of the client certificate by the management nexus.

5. The system of claim 1 , wherein the processor-implemented server node is further configured to:

receiving from the management nexus, an identifier of another processor-implemented server node storing an alternative version of the share;

establishing communication with the other server node; and

updating the share stored by the server node with the alternative version of the share stored by the other server node via the established communication.

6. The system of claim 1 , wherein the processor-implemented server node is further configured to:

receive a client certificate from the client node; and

responsive to receiving the client certificate, send a server certificate to the client node, wherein the client node is configured to send the server certificate to the management nexus to verify a status of the server certificate and access the data in the share associated with the server node responsive to the verification of the server certificate.

7. The method of claim 3 , further comprising:

receiving from the management nexus, an identifier of another processor-implemented server node storing an alternative version of the share;

establishing communication with the other server node; and

updating the share stored by the server node with the alternative version of the share stored by the other server node via the established communication.

8. The method of claim 3 , further comprising:

receiving a client certificate from the client node; and

responsive to receiving the client certificate, sending a server certificate to the client node, wherein the client node is configured to send the server certificate to the management nexus to verify a status of the server certificate and access the data in the share associated with the server node responsive to the verification of the server certificate.

9. A computer-implemented method comprising:

storing in a management nexus, a plurality of identifiers of shares each stored on one or more server nodes, each share comprising one or more data files;

receiving a request from a client node to access data in a share;

identifying the server node storing the requested share based on the stored identifiers;

responsive to determining the server node storing the requested share is unreachable, identifying a server node storing a copy of the requested share; and

establishing by the management nexus, a communication session between a relay server and the server node storing the copy of the requested share, the client node configured to access the data in the requested share via the communication session between the relay server and the server node storing the copy of the requested share without sending the data to the management nexus.

10. The method of claim 9 , wherein establishing the communication session between the relay server and the server node storing the copy of the requested share comprises:

determining the server node storing the copy of the requested share is behind a firewall; and

establishing the communication session between the relay server and the server node storing the copy of the requested share dynamically in response to determining the server node storing the copy of the requested share is behind the firewall.

11. The method of claim 9 , wherein establishing the communication session between the relay server and the server node storing the copy of the requested share comprises:

verifying by the management nexus, a client certificate associated with the client node; and

authorizing the client node to access the data in the share responsive to the verification of the client certificate, the communication session established responsive to the authorization.

12. The method of claim 9 , wherein each of the identifiers of shares comprises an access control list specifying user permissions for the respective share, and wherein establishing the communication session between the relay server and the server node storing the copy of the requested share comprises authorizing a user of the client node to access the data in the requested share based on the access control list of the requested share.

13. The method of claim 9 , wherein each of the identifiers of shares comprises a version number of the respective share at each of the one or more server nodes storing the respective share, and wherein identifying the server node storing the copy of the requested share comprises identifying the server node storing a current version of the requested share based on the stored version numbers.

14. The method of claim 9 , wherein each of the identifiers of shares comprises a version number of the respective share at each of the one or more server nodes storing the respective share, the method further comprising:

receiving from a first server node storing the respective share, a request to synchronize the respective share with other server nodes storing the respective share;

identifying a second server node storing a current version of the respective share; and

establishing a communication session between the first server node and the second server node, the first server node configured to update the share stored by the first server node with the current version of the share stored by the second server node via the established communication session.

Assignments (10)