System and method for creating conditional immutable objects in a storage device
View Patent ↗A data storage system includes a storage device and a data handler that receives an object, creates metadata for the object that includes a key and an authorization, stores the object on the storage device, receives a request for the object, determines if the request includes the key, and, if the request has authorization information, permits access to the object. The data handler receives another request for the object, determines if the request includes the key, and, if the request does not have the authorization information, denies access to the object.
1. A data storage system comprising:
a storage device; and
a data handler coupled to the storage device and operable to:
receive a first access request for a data object stored on the storage device, the data object including object data and metadata, the metadata including a key, a first authorization field, and a second authorization field;
determine that the first access request includes the key;
determine that the first access request includes information associated with the first authorization field in response to determining that the first access request includes the key;
permit an execution of a first operation on the data object in response to determining that the first access request includes information associated with the first authorization field;
receive a second access request for the data object;
determine that the second access request includes the key;
determine that the second access request includes information associated with the second authorization field in response to determining that the second access request includes the key; and
deny the execution of the first operation on the data object in response to determining that the second access request includes information associated with the second authorization field.
2. The data storage system of claim 1 , wherein the first and second authorization fields each include a plurality of operation fields operable to permit a plurality of operations on the data object, the operation fields including at least one of:
a first operation field to enable writing of the data object to the storage device;
a second operation field to enable modifying of the data object on the storage device;
a third operation field to enable reading of the data object from the storage device; and
a fourth operation field to enable deleting of the data object from the storage device.
3. The data storage system of claim 2 , wherein:
the first authorization field includes a first type field;
the second authorization field includes a second type field;
in determining that the first access request includes information associated with the first authorization field, the data handler is further operable to determine if the first access request includes the first type field; and
in determining that the second access request includes information associated with the second authorization field, the data handler is further operable to determine if the second access request includes the second type field.
4. The data storage system of claim 3 , wherein the first access request corresponds with the first type field when the first access request is received from a user group associated with the first type field.
5. The data storage system of claim 3 , wherein the first access request corresponds with the first type field when the first access request is received at a first particular time, wherein the first particular time relative to a second particular time that is indicated by the first type field.
6. The data storage system of claim 5 , wherein the first particular time is before the second particular time.
7. The data storage system of claim 5 , wherein the first particular time is after the second particular time.
8. The data storage system of claim 1 , wherein the data handler is further operable to:
deny an execution of a second operation on the data object in response to determining that the first access request includes information associated with the first authorization field; and
permit the execution of the second operation on the data object in response to determining that the second access request includes information associated with the second authorization field.
9. A method comprising:
receiving, at a data handler coupled to a storage device, a first access request for a data object stored on the storage device, the data object including object data and metadata, the metadata including a key, a first authorization field, and a second authorization field;
determining that the first access request includes the key;
determining that the first access request includes information associated with the first authorization field in response to determining that the first access request includes the key;
permitting an execution of a first operation on the data object in response to determining that the first access request includes information associated with the first authorization field
receiving a second access request for the data object;
determining that the second access request includes the key;
determining that the second access request includes information associated with the second authorization field in response to determining that the second access request includes the key; and
denying the execution of the first operation on the data object in response to determining that the second access request includes information associated with the second authorization field.
10. The method of claim 9 , wherein the first and second authorization fields each include a plurality of operation fields operable to permit a plurality of operations on the data object, the operation fields including:
a first operation field to enable writing of the data object to the storage device;
a second operation field to enable modifying of the data object on the storage device;
a third operation field to enable reading of the data object from the storage device; and
a fourth operation field to enable deleting of the data object from the storage device.
11. The method of claim 10 , wherein:
the first authorization field includes a first type field;
the second authorization field includes a second type field;
in determining that the first access request includes information associated with the first authorization field, the method further comprises determining if the first access request includes the first type field; and
in determining that the second access request includes information associated with the second authorization field, the method further comprises determining if the second access request includes the second type field.
12. The method of claim 11 , wherein the first access request corresponds with the first type field when the first access request is received from a user group associated with the first type field.
13. The method of claim 11 , wherein the first access request corresponds with the first type field when the first access request is received at a first particular time, wherein the first particular time relative to a second particular time that is indicated by the first type field.
14. The method of claim 13 , wherein the first particular time is before the second particular time.
15. The method of claim 9 , further comprising:
denying an execution of a second operation on the data object in response to determining that the first access request includes information associated with the first authorization field; and
permitting the execution of the second operation on the data object in response to determining that the second access request includes information associated with the second authorization field.
16. Machine-executable code for an information handling system, wherein the machine-executable code is embedded within a non-transitory medium and includes instructions for carrying out a method, the method comprising:
receiving, at a data handler coupled to a storage device, a first access request for a data object stored on the storage device, the data object including object data and metadata, the metadata including a key, a first authorization field, and a second authorization field;
determining that the first access request includes the key;
determining that the first access request includes information associated with the first authorization field in response to determining that the request includes the key;
permitting an execution of a first operation on the object in response to determining that the first access request includes information associated with the first authorization field;
receiving a second access request for the data object;
determining that the second access request includes the key;
determining that the second access request includes information associated with the second authorization field in response to determining that the second access request includes the key; and
denying the execution of the first operation on the data object in response to determining that the second access request includes information associated with the second authorization field.
17. The machine-executable code of claim 16 , wherein:
the first authorization field includes a first type field;
the second authorization field includes a second type field;
in determining that the first access request includes information associated with the first authorization field, the method further comprises determining if the first access request includes the first type field; and
in determining that the second access request includes information associated with the second authorization field, the method further comprises determining if the second access request includes the second type field.
18. The machine-executable code of claim 17 , wherein the first access request corresponds with the first type field when the first access request is received from a user group associated with the first type field.
19. The machine-executable code of claim 18 , wherein the first access request corresponds with the first type field when the first access request is received at a first particular time, wherein the first particular time relative to a second particular time that is indicated by the first type field.
20. The machine-executable code of claim 16 , the method further comprising:
denying an execution of a second operation on the data object in response to determining that the first access request includes information associated with the first authorization field; and
permitting the execution of the second operation on the data object in response to determining that the second access request includes information associated with the second authorization field.