Systems and methods for producing access control list caches including effective information access permissions across disparate storage devices
The disclosed computer-implemented method for producing access control list caches including effective information access permissions across disparate storage devices may include (i) receiving, at a computing device, an instruction to prepare an access control list (ACL) cache and (ii) performing a security action. The security action may include (A) recursively parsing, at the computing device, at least one respective ACL for information stored on at least two disparate storage devices, (B) identifying, at each step of recursion, each direct user and each indirect user having information access permissions in at least one of the respective ACLs, (C) determining, for each unique user in the respective ACLs, per-control point effective permissions, and (D) storing the per-control point effective information access permissions in the ACL cache. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for producing access control list caches including effective information access permissions across disparate storage devices, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, at the computing device, an instruction to prepare an access control list (ACL) cache; and
performing a security action, the security action comprising:
recursively parsing, at the computing device, at least one respective ACL for information stored on at least two disparate storage devices;
identifying, at each step of recursion, each direct user and each indirect user having information access permissions in at least one of the respective ACLs;
determining, for each unique user in the respective ACLs, per-control point effective information access permissions across the at least two disparate storage devices, wherein each control point is a level in an information storage hierarchy at which respective access control is present; and
storing the per-control point effective information access permissions in the ACL cache.
2. The computer-implemented method of claim 1 , further comprising:
fetching, for each file stored on the at least two disparate storage devices, the respective ACLs;
looking-up, in the ACL cache, each respective ACL; and
performing the security action when the information describing each ACL is absent from the ACL cache.
3. The computer-implemented method of claim 2 , further comprising periodically repeating the fetching, the looking-up, and the performing the security action.
4. The computer-implemented method of claim 1 , further comprising receiving the instruction to prepare the ACL cache in response to the ACL cache being invalidated.
5. The computer-implemented method of claim 1 , further comprising searching the ACL cache for a per-control point effective information access permission for a specific user.
6. The computer-implemented method of claim 1 , wherein the control point is a file.
7. The computer-implemented method of claim 1 , wherein the control point is a folder.
8. The computer-implemented method of claim 1 , wherein the security action further comprises generating a report of information in the ACL cache.
9. The computer-implemented method of claim 1 , wherein the security action further comprises displaying information from the ACL cache on a display device.
10. The computer-implemented method of claim 1 , further comprising storing the per-control point effective information access permissions in the ACL cache in a per-user, per-access format comprising a user identifier, respective information access type, and respective access permission mask information.
11. A system for producing access control list caches including effective information access permissions across disparate storage devices, the system comprising:
a first receiving module, stored in a memory, that receives an instruction to prepare an access control list (ACL) cache; and
a first performing module, stored in the memory, that performs a security action, the security action comprising:
recursively parsing, at the system, at least one respective ACL for information stored on at least two disparate storage devices;
identifying, at each step of recursion, each direct user and each indirect user having information access permissions in at least one of the respective ACLs;
determining, for each unique user in the respective ACLs, per-control point effective information access permissions across the at least two disparate storage devices, wherein each control point is a level in an information storage hierarchy at which respective access control is present;
storing the per-control point effective information access permissions in the ACL cache; and
at least one physical processor that executes the receiving module and the performing module.
12. The system of claim 11 , further comprising:
a fetching module, stored in the memory, that fetches, for each file stored on the at least two disparate storage devices, the respective ACLs;
a looking-up module, stored in the memory, that looks-up, in the ACL cache, each respective ACL; and
a second performing module, stored in the memory, that performs the security action when the information describing each ACL is absent from the ACL cache.
13. The system of claim 12 , wherein the fetching module, the looking-up module, and the second performing module periodically repeat the fetching, the looking-up, and the performing the security action.
14. The system of claim 11 , further comprising a second receiving module, stored in the memory, that receives the instruction to prepare the ACL cache in response to the ACL cache being invalidated.
15. The system of claim 11 , further comprising a searching module, stored in the memory, that searches the ACL cache for a per-control point effective information access permission for a specific user.
16. The system of claim 11 , wherein the security action further comprises displaying information from the ACL cache on a display device.
17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
receive, at the computing device, an instruction to prepare an access control list (ACL) cache; and
perform a security action, the security action comprising:
recursively parsing, at the computing device, at least one respective ACL for information stored on at least two disparate storage devices;
identifying, at each step of recursion, each direct user and each indirect user having information access permissions in at least one of the respective ACLs;
determining, for each unique user in the respective ACLs, per-control point effective information access permissions across the at least two disparate storage devices, wherein each control point is a level in an information storage hierarchy at which respective access control is present; and
storing the per-control point effective information access permissions in the ACL cache.
18. The non-transitory computer-readable medium of claim 17 , wherein the security action further comprises:
fetching, for each file stored on the at least two disparate storage devices, the respective ACLs;
looking-up, in the ACL cache, each respective ACL; and
performing the security action when the information describing each ACL is absent from the ACL cache.
19. The non-transitory computer-readable medium of claim 17 , further comprising one or more computer-executable instructions that, when executed by the at least one processor of the computing device, cause the computing device to receive the instruction to prepare the ACL cache in response to the ACL cache being invalidated.
20. The non-transitory computer-readable medium of claim 17 , wherein the security action further comprises searching the ACL cache for a per-control point effective information access permission for a specific user.
21. The non-transitory computer-readable medium of claim 17 , wherein the security action further comprises displaying information from the ACL cache on a display device.