Granted Patent B2

US 12,585,805 · App. 17/381,883 · Granted Mar 24, 2026

Inventors: Catherine Powell (Boston, MA); Joseph Daniel Powell (Boston, MA); Kevin Day (Shelburne Falls, MA); Bruce Duncan (Walkersville, MD)

Assignee: Box, Inc.

G06F21/6218G06F16/214G06F16/2246

Abstract

Claims (52)

1 . A method for identifying and resolving conflicts in access permissions during migration of data and user accounts from a source system to a target system, the method comprising:

receiving, by a migration control system, a set of mappings, the set of mappings comprising path mappings of a hierarchy of data objects on the source system to locations on the target system for migrated data objects and subject mappings of user accounts on the source system to user accounts on the target system, wherein the migration of data and user accounts comprises migrating the data objects from the source system to the target system and migrating existing user accounts on the source system to new user accounts on the target system;

translating, by the migration control system, based on the received set of mapping, permissions controlling access to the data objects of the hierarchy of data objects on the source system to permissions controlling access to the migrated data objects on the target system for one or more user accounts on the target system;

detecting, by the migration control system, one or more conflicts between the permissions controlling access to the data objects of the hierarchy of data objects on the source system and the permissions controlling access to the migrated data objects on the target system for at least one user account of the one or more user accounts;

selecting, by the migration control system, a conflict resolution strategy from a plurality of conflict resolution strategies, wherein the conflict resolution strategy comprises one of a warn-and-skip conflict resolution strategy, an expansive conflict resolution strategy, or a restrictive conflict resolution strategy; and

applying, by the migration control system, the selected conflict resolution strategy to the permissions controlling access to the migrated data objects on the target system for the at least one user account, wherein applying the expansive conflict resolution strategy comprises identifying permissions for a parent data object of the data object on the source system for which the conflict has been detected at a level of the hierarchy of data objects of the source system above the data object on the source system for which the conflict has been detected, removing permissions for the migrated data for which the conflict has been detected on the target system, and allowing inheritance of the identified permissions for the parent data object by each child data object on the target system for which the conflict has been detected.

2 . The method of claim 1 , wherein applying the warn-and-skip conflict resolution strategy comprises presenting an indication of the data or the user account on the source system for which a conflict has been detected.

3 . The method of claim 1 , wherein applying the restrictive conflict resolution strategy comprises:

identifying the parent data object of the data object on the source system for which the conflict has been detected;

determining whether the identified parent data object explicitly defines permissions or is a root level of the hierarchy; and

in response to determining the identified parent data object defines permissions or is the root level of the hierarchy, removing permissions for the at least one user account from the identified parent data object, adding the parent data object to a reprocessing list, identifying a child data object for the identified parent data object at a lower level of the hierarchy than the identified parent data object, and removing permissions from the identified child data object.

4 . The method of claim 3 , wherein applying the restrictive conflict resolution strategy further comprises:

determining whether additional conflicts exist;

determining whether any paths have been added to the reprocessing list;

determining whether an iteration limit for the restrictive conflict resolution strategy has been reached; and

in response to determining additional conflicts exist, determining paths have been added to the reprocessing list, and determining the iteration limit for the restrictive conflict resolution strategy has not been reached, repeating one or more conflicts between the permissions controlling access to the data objects of the hierarchy of data objects on the source system and the permissions controlling access to the migrated data objects on the target system for at least one user account of the one or more user accounts and applying the selected conflict resolution strategy to the permissions controlling access to the migrated data objects on the target system for the at least one user account until determining no paths remain on the reprocessing list or determining the iteration limit for the restrictive conflict resolution strategy has been reached.

5 . The method of claim 1 , wherein the source system comprises one of a cloud-based system or an on-premise system and the target system comprises a cloud-based system.

6 . A system comprising:

a processor; and

a memory coupled with and readable by the processor and storing therein a set of instructions which, when executed by the processor, causes the processor to identify and resolve conflicts in access permissions during migration of data and user accounts from a source system to a target system by:

receiving a set of mappings, the set of mappings comprising path mappings of a hierarchy of data objects on the source system to locations on the target system for migrated data objects and subject mappings of user accounts on the source system to user accounts on the target system, wherein the migration of data and user accounts comprises migrating the data objects from the source system to the target system and migrating existing user accounts on the source system to new user accounts on the target system;

translating based on the received set of mapping, permissions controlling access to the data objects of the hierarchy of data objects on the source system to permissions controlling access to the migrated data objects on the target system for one or more user accounts on the target system;

detecting one or more conflicts between the permissions controlling access to the data objects of the hierarchy of data objects on the source system and the permissions controlling access to the migrated data objects on the target system for at least one user account of the one or more user accounts;

selecting a conflict resolution strategy from a plurality of conflict resolution strategies, wherein the conflict resolution strategy comprises one of a warn-and-skip conflict resolution strategy, an expansive conflict resolution strategy, or a restrictive conflict resolution strategy; and

applying the selected conflict resolution strategy to the permissions controlling access to the migrated data objects on the target system for the at least one user account, wherein applying the expansive conflict resolution strategy comprises identifying permissions for a parent data object of the data object on the source system for which the conflict has been detected at a level of the hierarchy of data objects of the source system above the data object on the source system for which the conflict has been detected, removing permissions for the migrated data for which the conflict has been detected on the target system, and allowing inheritance of the identified permissions for the parent data object by each child data object on the target system for which the conflict has been detected.

7 . The system of claim 6 , wherein applying the warn-and-skip conflict resolution strategy comprises presenting an indication of the data or the user account on the source system for which a conflict has been detected.

8 . The system of claim 6 , wherein applying the restrictive conflict resolution strategy comprises:

identifying the parent data object of the data object on the source system for which the conflict has been detected;

determining whether the identified parent data object explicitly defines permissions or is a root level of the hierarchy; and

in response to determining the identified parent data object defines permissions or is the root level of the hierarchy, removing permissions for the at least one user account from the identified parent data object, adding the parent data object to a reprocessing list, identifying a child data object for the identified parent data object at a lower level of the hierarchy than the identified parent data object, and removing permissions from the identified child data object.

9 . The system of claim 8 , wherein applying the restrictive conflict resolution strategy further comprises:

determining whether additional conflicts exist;

determining whether any paths have been added to the reprocessing list;

determining whether an iteration limit for the restrictive conflict resolution strategy has been reached; and

in response to determining additional conflicts exist, determining paths have been added to the reprocessing list, and determining the iteration limit for the restrictive conflict resolution strategy has not been reached, repeating one or more conflicts between the permissions controlling access to the data objects of the hierarchy of data objects on the source system and the permissions controlling access to the migrated data objects on the target system for at least one user account of the one or more user accounts and applying the selected conflict resolution strategy to the permissions controlling access to the migrated data objects on the target system for the at least one user account until determining no paths remain on the reprocessing list or determining the iteration limit for the restrictive conflict resolution strategy has been reached.

10 . The system of claim 6 , wherein the source system comprises one of a cloud-based system or an on-premise system and the target system comprises a cloud-based system.

11 . A non-transitory, computer-readable medium comprising a set of instructions stored therein which, when executed by a processor, causes the processor to identify and resolve conflicts in access permissions during migration of data and user accounts from a source system to a target system by:

receiving a set of mappings, the set of mappings comprising path mappings of a hierarchy of data objects on the source system to locations on the target system for migrated data objects and subject mappings of user accounts on the source system to user accounts on the target system, wherein the migration of data and user accounts comprises migrating the data objects from the source system to the target system and migrating existing user accounts on the source system to new user accounts on the target system;

translating based on the received set of mapping, permissions controlling access to the data objects of the hierarchy of data objects on the source system to permissions controlling access to the migrated data objects on the target system for one or more user accounts on the target system;

detecting one or more conflicts between the permissions controlling access to the data objects of the hierarchy of data objects on the source system and the permissions controlling access to the migrated data objects on the target system for at least one user account of the one or more user accounts;

selecting a conflict resolution strategy from a plurality of conflict resolution strategies, wherein the conflict resolution strategy comprises one of a warn-and-skip conflict resolution strategy, an expansive conflict resolution strategy, or a restrictive conflict resolution strategy; and

applying the selected conflict resolution strategy to the permissions controlling access to the migrated data objects on the target system for the at least one user account, wherein applying the expansive conflict resolution strategy comprises identifying permissions for a parent data object of the data object on the source system for which the conflict has been detected at a level of the hierarchy of data objects of the source system above the data object on the source system for which the conflict has been detected, removing permissions for the migrated data for which the conflict has been detected on the target system, and allowing inheritance of the identified permissions for the parent data object by each child data object on the target system for which the conflict has been detected.

12 . The non-transitory, computer-readable medium of claim 11 , wherein applying the warn-and-skip conflict resolution strategy comprises presenting an indication of the data or the user account on the source system for which a conflict has been detected.

13 . The non-transitory, computer-readable medium of claim 11 , wherein applying the restrictive conflict resolution strategy comprises:

identifying the parent data object of the data object on the source system for which the conflict has been detected;

determining whether the identified parent data object explicitly defines permissions or is a root level of the hierarchy; and

in response to determining the identified parent data object defines permissions or is the root level of the hierarchy, removing permissions for the at least one user account from the identified parent data object, adding the parent data object to a reprocessing list, identifying a child data object for the identified parent data object at a lower level of the hierarchy than the identified parent data object, and removing permissions from the identified child data object.

14 . The non-transitory, computer-readable medium of claim 13 , wherein applying the restrictive conflict resolution strategy further comprises:

determining whether additional conflicts exist;

determining whether any paths have been added to the reprocessing list;

determining whether an iteration limit for the restrictive conflict resolution strategy has been reached; and

in response to determining additional conflicts exist, determining paths have been added to the reprocessing list, and determining the iteration limit for the restrictive conflict resolution strategy has not been reached, repeating one or more conflicts between the permissions controlling access to the data objects of the hierarchy of data objects on the source system and the permissions controlling access to the migrated data objects on the target system for at least one user account of the one or more user accounts and applying the selected conflict resolution strategy to the permissions controlling access to the migrated data objects on the target system for the at least one user account until determining no paths remain on the reprocessing list or determining the iteration limit for the restrictive conflict resolution strategy has been reached.

Assignments (2)

Continuity (1)

References Cited (26)