TWI309775B - Method for getting user's access authority by traveling around access control list - Google Patents

Description

1309775 __案号 92129260_年月曰 修修___ V. OBJECT DESCRIPTION OF THE INVENTION (1) Technical Field of the Invention The present invention relates to the field of file system security, and more particularly to a method of traversing access rights in a control list. [Prior Art] In a NAS (Network Attached Storage) architecture storage system, the permission setting of the user premises is crucial. At present, there are many methods involved in the setting of user document permission rights. However, there are not many methods related to the setting of user document permission settings. For example, the 11th CN1 395 1 78A published by the State Intellectual Property Office of China on February 5, 2020 The patent application is named "File Usage Authority Setting System and Method". The patent application sets at least part of the permission setting data of a file according to the user identification data and the user authority data contained in the permission setting data package, and uses the permission checking module and the authority in the file using the file permission setting system. The module is configured to implement the above functions in order to improve the efficiency of the user document management process and the security of document protection. The shortcoming of the technology disclosed in the patent application is that although it solves the problem of setting the rights of the user document, it does not solve the problem of quickly obtaining the permission setting value required by the user in the access control list. For example, a user's access to a document typically triggers the following actions: First, check if the user has permission to operate the user's document, and if necessary, the user is allowed to operate on the document. The process of checking the permission setting value is as follows: firstly, starting from the upper directory of the user document, the permission setting value of the lower directory of the user document is searched down one by one until the query scraps the directory where the user document is located. One shortcoming of this kind of query is that the cache memory can only be temporarily stored for the last time.

Page 7 1309775 __ Case No. 92129260 V. Invention Description (2) ^--^ 曰 Correct ___ one-time query intermediate result, $ _ fruit, when a similar query occurs ^ use the middle of the last query process . The second deficiencies ^ ’ can only be re-queried. It takes more time to repeat the above-mentioned settings, and the permission required for querying a certain user is set. [Summary of the invention] It is less efficient. For the above method, the main purpose of the present invention is to provide a cache memory and a second cache method: a method for acquiring a user request based on the temporary storage at the first speed. License $ recall, in the permission setting information, fast

The second cache memory does not find the user in the first cache memory and the alpha and the market permission setting values, starting from the lower directory of the text that the user wants to access, and querying the upper layer layer by layer. Directory 'until you get the required privilege to set the value. When there is a similar permission setting value query action, you can quickly query and obtain the permission setting value required by the user to speed up the query.

The present invention provides a method for traversing an access control list, which includes a first cache memory, which is the first memory accessed by the network attached memory for performing user permission setting value auditing, and is used for storing the first number. The information block, the first information block is used to record the user permission setting value that has been accessed recently; and the second cache memory is the network attached error memory device that accesses the user permission in the first memory. When the set value is missing, the cache memory of the first query is used to store a plurality of second information blocks, and the second information block is used to record the intermediate leaf calculation result and the document directory of the accessed user permission setting value. The upper and lower relationship; a permission query module is used to query the user license in the first cache memory and the second cache memory

Page 8 1309775

The license right setting value and the trick group are used to generate the storage into the first cache block and the second information block; a permission setting information will be The current permission setting value enters the first information block and the first memory and the second quick right setting value, and the first cache memory group is used to generate a module according to the value setting and inheritance permission. The present invention provides a traversal access control list in which the permission includes: step: establishing in the root directory of the document system - the dummy node is a virtual access control list identification word; In the cache memory, the first information block is the user permission setting value that has been accessed last time; and according to the 甩/Θ permission identification word, the identifiable character and a current license are queried in the second cache memory. Set the value; determine whether to find the license identification word and the current permission setting value; if it is the first information block, if no, perform the following steps: use the current value and the integration permission setting value integration The result replaces the inheritance value 'and replaces the last query word with the current permission ID' to restart the above steps; depending on the license permission, whether the operation requested by the user is allowed. [Embodiment] Please refer to the first figure, which is an implementation environment for traversing the access control permission method of the present invention. The implementation environment includes a network attached 1, a first cache memory 2, a second cache memory 3, and a network 4 stored in the integration mode permission set line integration; a second information acquisition memory method, a meta node thereof, Add a first for the record 1 identification word, a cumulative permission to the required 'is then generate a permission set permission set to identify the value of the judgment system list plus memory and a plurality of

V. Description of invention (4) :;:: 'Set 5. The network 4 can be an intranet or a wide area network, and the connection network is used. The network attached memory is built in the user's end, ^ is the body 3. The plurality of user terminals; and the second = file entry bar is used to attach a force to the user network: 1 the operation includes reading, writing, deleting, changing, and the like. The memory 1 is used to store a plurality of user files. The 7 Temple license is the traversal visit V control list of the present invention: the memory i, a first cache memory 2 group map; the network add-on network add-on memory i-communication -: memory 3. The cache memory 3 is separately linked. The network: "" and the second recording management ceremony 1 Λ ^ ω, "the road attached memory 1 includes a directory module 10, a permission calculation module u, a permission integration module i 3 and _ D —- ' Record management module 1〇, is used to enter the directory = into module 14. Among them, the operation is changed. The permission calculation module u ‘takes:; enters, deletes, and repairs the value Pc. The permission query module, j 2 is used to calculate the current permission. The second cache memory 3 queries the current-cache memory 2 and the current user access object\= ghost= and the second information block 30. Quickly complete .., 0,, and inherit the permission setting value P丨. The information block H H20 tooth second generation generates the first information block 3 stored in the first cache memory 2 and the second information block 3 of the memory 3. In the middle door to store the query process... As a result, the day, the, and the fruit are stored in the way of a negative block 2 (1 66 士 _ι;, the first information block is 1309775

1309775 __Case No. 92129260_Year of the month a 佟庀 _ _, invention description (6) permission method integration calculation rules table. The table lists the merge rule of the current permission setting value Pc and the inherited permission setting value P!, and the specific operation rule is: NA (unable to access) takes precedence over R〇 (readable), w〇 (writable) ), RW (read and write) and FC (full control), R〇 (readable) and w〇 (writable) combined result is RW (read and write), FC (full control) contains RW (can Read and write). In addition, the directory management module 1 〇 preset directory permission priority level is that the lower directory priority is higher than the upper directory ’, that is, the current permission setting value pc is prior to the inheritance permission setting value p!. When the license integration module 13 performs the license setting value integration, the permission query module 12 stops the upper layer permission query as long as the result of the above-mentioned permission integration is NA (unable to access) or FC (full control). It is thus possible to determine whether the operation requested by the user is permitted. Please refer to the fourth figure, which is the main flow chart of the permission method in the traversal access control list of the present invention. First, the process starts the permission audit of the directory (step S400), and the permission query module 12 queries the current permission identification word Ic in the manner of the information block <il, ic, u, PL> (step s4〇1), Whether the current user's inheritance permission setting value Ρι exists in the first cache memory 2 (step S4〇2) ° If yes, the flow performs the following determination if the current user's scene is present in the first cache memory 2 The license identification word IL, the license integration module $1, and the user's inheritance permission setting value Ρι and the trick permission setting value PL are combined to replace the master permission setting value h, wherein the permission integration system According to the permission integration calculation rule table shown in the third figure of the present invention, the relevant 5th time can be integrated; if the current user does not exist in the first cache 2, the license identification word is directly set by the inheritance permission. The value replaces the purple "ten permission setting value PL (step s 4 〇 3 ). Next, judge the second cache

Page 12 1309775 --~1S_92129260_年月月日五, invention description (7) If there is a current permission setting value of the current permission identification word 丨c in the hidden=3 ^2^4 04), and then judge the user The trick permission setting value 匕 is = the 5 permission value set by the user (step S4 〇 5), if it does not match the 2 2 = the user request operation (step S4 〇 6) 'Otherwise, the user 2 is allowed to endure St seeks the operation (step S4〇7). If the permission query module 12 does not find the current user's inheritance permission setting value P: in the step boat, the method of entering the first and second two blocks is <u, II, Ic, Pc> Take the current permission setting value of Ϊ Ϊ 记忆 匕 (step S408) 'If found, perform the following steps: If the current user's permission permission value ρ is found, the right integration module 13 will be The user's current permission is set to the total dm right: the call is based on the license right in the third figure. The table is replaced by the f-permission setting value PL. Otherwise, it is directly used as the permission setting. The value p you S41 ίΠ. ^ ^ a ^ C generation f permission setting value 匕 (step 641 ϋ j. Right in step S408, force female too a this, further calculation order) and then find the current permission setting value Pc, then 鍫Following the wrestling "I, although the permission setting value pc (step S4〇9), the question is whether the inheritance permission 2 is required to be ^1/1 the calculation module 11 issues the inherited permission setting value P_rm (step S4U) 'If you do not need .τ ττ ρ . ^ ^ χ 1 矾 矾 block generation module 1 4 generates the first information * J ' , ', and the mouth into the first cache 2 (step s 2: : Λ / / step 8404, the loop process is executed. If it is judged that the privilege of the inheritance is required to be inherited, the information block generation module 14 generates the J> Adding to the second cache memory 3 other words Il (step paste (4), ^ can identify the right ^ replace the f count permission right this 'permission query module 1 2 to send an inquiry,

Page 13 1309775 --- Case No., 21.29260--Year Month H ^ V. Invention Description (8) &quot; ~ -- = Whether the previous permission identification word ic exists in the upper management directory (step s4i5), = exists, Then, the upper layer control list information code is used to replace the current permission identification=IC (step S416), and the upper layer control list information code is the permission setting information code of the directory management group 1 〇 preset layer directory, otherwise, The control list information code of the dummy node replaces the current permission identification word ic (step S 4 17), and the control list information code of the dummy node is a preset permission setting value code, wherein the dummy node preset Two types of users and corresponding permission setting settings: The administrator has full control of the user's document, which is readable and writable by the average user. Referring to the fifth figure, the second cache memory flow chart of the query method for traversing the permission method in the access control list of the present invention. The process starts from the main process entry point (step S 5 1), adds the information block <ic, p! &gt; to the stack S (step S52), determines whether the stack s is empty (step S53), and if so, enters The loop process 'restarts execution from the main flow entry point (step S54). If the stack S is not empty, a set of &lt; iL, pc&gt; elements are taken out from the stack s (step S55) 'then' and try to find a set in the second cache memory 3 by &lt;iL, u&gt; The second information block &lt; u, iL, ic, pc &gt;, and the second information block is removed from the second cache (step S56). If the second information block &lt;U, IL, Ic, pc&gt; is not found, the flow goes directly to step S53 to enter the loop process. If the second information block &lt;u, IL, Ic, Pc&gt; is found, the information block &lt; Ic, U, Mer ge (P), Pc) &gt; is added to the first cache 2 (step S57), wherein Merge(p丨, pc) integrates the inheritance permission setting value Ρι and the current permission setting value Pc according to the permission integration calculation rule table shown in the third figure of the present invention. The weight is set to P!.

Page 14 1309775

Next, the process issues an inquiry as to whether the current user's license permission identification word iL is a valid control authority information code (step S58), and if so, adds <iL'MergeCPpPc)> to the stack s (step S59), and proceeds to the step The loop process begins at S56. If it is judged that the IL is invalid control authority sfl dam, the flow grain directly goes to step S 56 to start the loop process. The above is only the preferred embodiment of the present invention, and has been used in a wide range of applications, and all other equivalent changes or modifications that have been made without departing from the spirit of the present invention should be included in the following application. Within the scope of the patent.

Page 15 1309775 _ Case No. 92129260_年月曰 修正 Correction _ Schematic description of the diagram [Simple description of the diagram] The first diagram is the implementation environment for the privilege method in the traversal access control list of the present invention. The second figure is a functional module diagram of the method for traversing the permission method in the access control list of the present invention. The third figure is a license integration calculation rule table for traversing the permission method in the access control list of the present invention. The fourth figure is the main flow chart of the permission method in the traversal access control list of the present invention. The fifth figure is a flow chart of the second cache memory of the method for traversing the permission method in the access control list. Main component label] Network attached memory 1 - Cache memory 2 Second cache memory 3 Network 4 User terminal device 5 Directory management module 10 License calculation module 11 License query module 12 Permission integration Module 13 information block generation module 14 first information block 20 _ - information block 30

Claims (1)

1309775 曰, the scope of patent application - kind of traversal additional storage can be set to the user's permission right, the operation control list is in the document is a virtual permission to execute the first permission to modify the list of permission methods in the storage network value Second! The user permission setting value 'implements the same setting 佶 caches the user permission setting value, which is the operation permission of the user terminal device for the document: including reading, writing, deleting, modifying, the traversal access The ^ ° no-weight method includes the following steps: a dummy node is established in the root directory of the system, and the dummy identification character is prepared by the dummy node; the '· ^ block queries whether the inheritance setting exists in the second cache memory. If the value 'has the inheritance permission setting value, the judgment is further described; if the statistic permission identification word exists in the first cache, the sputum permission setting value and the inheritance permission setting value are integrated to replace the sputum The permission setting value; if there is no 许可 permission identification word in the first cache, the escrow permission setting value is directly replaced by the inheritance permission setting value; determining whether the current permission exists in the second cache memory The weight setting value further determines whether the setting value of the license permission meets the permission setting value requested by the user; if the inheritance permission setting does not exist in the second cache memory Value at a second information block is further query the current setting value of permissions in a second cache memory, performing the following steps; the second cache memory if the current setting value t permission exists, into a Page 17 1309775 Amends the 'patent application range step query t-count permission identification word exists, if it exists, the current permission setting value and the scenery permission setting value are combined to replace the f-count permission setting value; If there is no trick permission identification word in the cache memory, the current permission setting value is used instead of the system permission setting value; if the current permission setting value does not exist in the second cache, the calculation is performed. The user's current permission setting value, re-execute the above steps; determine whether the inheritance permission setting value is required; if the inheritance permission setting value is required, the second information block is added to the second cache memory, and the current permission is used. The identification word replaces the t-meter permission identification word; if the inheritance permission setting value is not required, the first information block is added to the first cache memory. 2. The traversal access control list permission method as described in claim 1 further comprising the next step of storing the plurality of second information blocks in the second cache. 3. The method of traversing an access control list as described in claim 1, wherein the first information block comprises a user identification word, a current permission identification word, and an inheritance permission setting value. 4. The traversal access control list permission method as described in claim 2, wherein the second information block comprises a user identification word, a license identification number, a current permission identification word, and a current permission. Settings. Page 18 1309775 _ Case No. 92129260 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ Usually the capacity is 4KB. 6. The traversal access control list permission method as described in claim 1, wherein the second cache memory can store up to 16 intermediate query results at a time. 7. The privilege method in the traversal access control list described in claim 1 of the patent scope, wherein the integration is based on a predetermined license integration calculation rule table for permission integration. 8. In the traversal access control list permission method described in claim 1, the dummy node is used to simplify the program flow in the data structure. 9. In the traversal access control list permission method as described in claim 1, the dummy node presets two types of users and corresponding permission settings: the administrator has full control of the user document, the general user Readable and writable. Page 19 1309775 _ES_92129260 The permission method in the list. The method provided by the present invention does not find the first cache memory, and then the user is not found in the memory. The user will set the value from the permission of the user document, and the value is set. On the same day, the same information will be stored in the __^ multi-positive, Chinese invention summary (invention name: traversing the access control list in the method / &quot; revealed a traversal of the user will find the use of two cache The request for the lower layer to the inquiry process is based on the first invention. The license record of the memory of a predetermined household is started in the middle of the meta-section, and the permission of the first user flow is checked. If the value is up, then if the value is up to the first second fast access control, then the configured value 'if it is in the above-mentioned record according to its process The user permission is set to the poor block and the memory is taken. (1) The representative figure of the case is: the fourth picture (2), the representative symbol of the representative figure of the case is a simple description: No. 5, English invention summary (invention name: Method For Getting User's Access Authority by Traveling Around Access Control List) A method for getting user's access authority by travelin When a user operates one of the files, the present invention will look for the user's authority value in a first cache memory according to a pre-set flowchart. Then the inquiry flowchart will look for in the second Cache memory if can't find the user's permission 1309775 _ Case No. 92129260_Yearly Month Day Amendment