WO2019000979A1 - 一种文件系统的权限设置方法及装置 - Google Patents

一种文件系统的权限设置方法及装置 Download PDF

Info

Publication number
WO2019000979A1
WO2019000979A1 PCT/CN2018/076743 CN2018076743W WO2019000979A1 WO 2019000979 A1 WO2019000979 A1 WO 2019000979A1 CN 2018076743 W CN2018076743 W CN 2018076743W WO 2019000979 A1 WO2019000979 A1 WO 2019000979A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
permission
accessed
global
version number
Prior art date
Application number
PCT/CN2018/076743
Other languages
English (en)
French (fr)
Inventor
谢晓芹
郭洪星
李永健
马满堂
鹿智婷
张军伟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18825506.1A priority Critical patent/EP3614290B1/en
Priority to JP2019561914A priority patent/JP6965370B2/ja
Publication of WO2019000979A1 publication Critical patent/WO2019000979A1/zh
Priority to US16/718,995 priority patent/US11238175B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/18—File system types
    • G06F16/182—Distributed file systems
    • G06F16/1824—Distributed file systems implemented using Network-attached Storage [NAS] architecture
    • G06F16/1827—Management specifically adapted to NAS
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6281—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database at program execution time, where the protection is within the operating system
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the embodiments of the present invention relate to the field of file systems, and in particular, to a method and an apparatus for setting permissions of a file system.
  • the file system is a structured form of data storage and organization.
  • a file system can be used after being mounted.
  • the organization of the file system is represented by a tree structure tree.
  • the directory tree includes files in the root directory, subdirectories, and subdirectories.
  • the subdirectories can contain not only files but also files. Contains the next level of subdirectories, and so on constitutes a directory tree for a multi-level directory structure.
  • the root of the tree structure is a mount point. In the directory tree, the root directory is located at the root node of the directory tree, the file is located at the leaf node of the directory tree, and the subdirectory is located at the intermediate node of the directory tree.
  • Each file and directory is an object to be accessed.
  • the Access Control Lists (ACLs) of the nodes to be accessed Before accessing the terminal device or the node that the application needs to access, query the Access Control Lists (ACLs) of the nodes to be accessed, obtain the access rights, and access the accesses. The data of the node. To control the access rights of different access devices to different nodes, configure an access control list for each node to configure the access rights of each node separately.
  • the ACL of each node includes a plurality of access control entries (ACEs), the access control items are used to record the access permission types of the nodes, and are used to record access devices that access the nodes. And content such as access rights of the access device to the node.
  • ACEs access control entries
  • the ACL of the node of the existing directory tree is set by setting an ACL to any node of the directory tree, and then setting an ACL for all nodes of the directory tree having the same access rights as any of the nodes, so that the directory tree is Each node performs repeated setting of ACLs, and the setting of access rights of nodes is inefficient.
  • the invention discloses a method and a device for setting a permission of a file system, and the method for setting a permission of the file system reduces the setting overhead and storage overhead of the ACL of the node.
  • the first aspect provides a method for setting a permission of a file system, where the method is applied to a storage system, including: the storage system receives a permission setting request, and the permission setting request is used to request a node on a directory tree of a file system.
  • An access permission setting that includes an identification and a permission record of a node to which the permission is to be set.
  • the storage system acquires the global version parameter of the current record, and updates the global version parameter of the current record to obtain the latest global version parameter.
  • the storage system saves the identifier and the permission record of the node to be set, and uses the latest global version parameter as the permission version number of the node to be set.
  • the global version parameter is incremented or decremented, and each global version parameter represents a permission setting operation of any node of the directory tree.
  • the permission record of the child node of the node to be set is inherited from the authority record after the current permission setting operation of the node to be set.
  • the method for setting a permission of a file system realizes a permission record for quickly setting an access right of a node of a directory tree, and represents a permission setting operation of an arbitrary node of the directory tree by an updated global version parameter, wherein the method
  • the permission record of the child node of the node that sets the permission is inherited from the permission record after the current permission setting operation of the node to be set, so only the permission record of the parent node of the directory tree is set, and the directory corresponding to the parent node is All the files and all subdirectories underneath inherit the permission records of the parent node, and do not traverse all the subdirectories or files under the parent node to set the permission records of each subdirectory or file under the parent node respectively, thereby improving the directory tree.
  • the efficiency of setting access permissions Set the permission record for the parent node, and do not need to repeatedly set the permission record for the subdirectories and files in the directory corresponding to the parent node, which reduces the storage space overhead.
  • the acquiring the global version parameter of the current record includes: querying the global access control list, acquiring a global version parameter of the current record, where the global access control list is saved in the directory In the metadata of the root node of the tree, the global access control list holds the global version parameter.
  • the method further includes: the storage system creating a global access control list, and the newly created global access control The list sets the initial global version parameters.
  • the permission setting request further includes path information of the node to be set, and a path of the node to be set The information indicates all nodes on the access branch from the root node to the node to which the permission is to be set
  • the method further includes: the storage system saves path information of the node to be set to the global access control a list, wherein the identifier, the path information, and the authority record of the node to which the permission is to be set form a set of correspondences.
  • the identifier of the node to be set, the path information, and the authority record form a set of correspondences, and are saved in the global access control list, only the metadata of the root node of the index tree can be obtained.
  • the identifier, path information, and permission record of the node to be set in the directory tree provide a convenient access path for obtaining the permission record and path information of the node of the directory tree.
  • the method further includes: the storage system receiving a request for accessing data,
  • the request to access data includes an identification of a node to be accessed.
  • the storage system acquires access rights of the to-be-accessed node according to the identifier of the to-be-accessed node.
  • the access authority of the to-be-accessed node is inherited from the to-be-accessed node when the permission version number of the to-be-accessed node is not the latest among the permission version numbers of all the nodes indicated by the path information of the to-be-accessed node. Access the permission record corresponding to the parent node of the node with the latest permission version number.
  • the storage system performs authentication according to the access right of the to-be-accessed node, and accesses the data of the to-be-accessed node after the authentication is passed.
  • the permission version number of the to-be-accessed node is a permission version number of all nodes indicated by the path information of the to-be-accessed node In the latest, the access right of the to-be-accessed node is the recorded permission record of the to-be-accessed node.
  • the storage system queries the permission version number of each node indicated by the path information of the node to be accessed, and confirms the node with the latest version number.
  • the storage system acquires the permission record of the node with the latest permission version number, and the permission record of the latest node of the permission version number is the access permission of the node to be accessed.
  • the querying the permission version number of each node indicated by the path information of the to-be-accessed node, and confirming the latest node with the permission version number includes: According to the preset traversal rule, the permission version number of each node indicated by the path information of the node to be accessed is compared, and the node with the latest version number is confirmed. Comparing the permission version number of each node indicated by the path information of the to-be-accessed node by a preset traversal rule, and confirming the node with the latest version number of the permission, the traversal rule may be preset according to the access authority distribution rule of the node in the directory tree. And comparing the permission version number of each node in the path of the to-be-accessed node by a suitable preset traversal rule, confirming the node with the latest version number of the permission, and improving the efficiency of the traversal comparison.
  • all the nodes indicated by the path information of each node in the directory tree belong to different directory levels, and each of the directory trees
  • the directory level of the parent node in all the nodes indicated by the path information of the node is higher than the directory level of the child node belonging to the parent node, the directory level of the node to be accessed is the lowest, and the directory level of the root node is the highest.
  • a preset traversal rule comparing a permission version number of each of the nodes indicated by the path information of the node to be accessed, and confirming a node with the latest version number, including: the storage system starts from the root node, Each time, the permission version number of two of the nodes indicated by the path information of the node to be accessed is selected and compared, and the node with the latest version number is confirmed.
  • the storage system is in the order of the directory level from high to low until the traversal comparison to the to-be-accessed node, and the latest node whose confirmed permission version number is the latest node of the permission version number.
  • all the nodes indicated by the path information of each node in the directory tree belong to different directory levels, and each of the directory trees
  • the directory level of the parent node in all the nodes indicated by the path information of the node is higher than the directory level of the child node belonging to the parent node, the directory level of the node to be accessed is the lowest, and the directory level of the root node is the highest.
  • the privilege version number of each of the nodes indicated by the path information of the node to be accessed is compared according to the preset traversal rule, and the node with the latest version number is confirmed, including: the storage system is to be accessed from the The node starts, and selects and compares the permission version numbers of the two nodes in all the nodes indicated by the path information of the node to be accessed each time, and confirms the node with the latest version number.
  • the storage system is in the order of the directory level from low to high until the traversal comparison to the root node, and the latest node whose confirmed permission version number is the latest node of the permission version number.
  • the method further includes: the storage system receiving a request for creating a node, where the node is created
  • the request includes the identification and path information of the newly added node of the directory tree, and the path information of the newly added node indicates all nodes on the access branch from the root node to the newly added node.
  • the storage system saves a correspondence between the identifier of the newly added node and the path information of the directory tree to the global access control list.
  • the storage system saves the permission version number of the newly added node to the global access control list, where an initial value of the permission version number of the newly added node is less than or equal to an initial value of the created global version parameter.
  • the newly added node inherits the access rights of the latest node of the permission version number of all the nodes indicated by the path information of the newly added node, so the setting of the access authority for the newly added node does not need to be stored.
  • the access record of the access rights of the newly added node improves the setting efficiency of the access rights of the newly added nodes, and saves the storage overhead of the access rights of the newly added nodes.
  • a second aspect provides a file system privilege setting device, comprising: a module for performing a privilege setting method of a file system in any one of the possible implementations of the first aspect or the first aspect, the module may be implemented by hardware
  • the corresponding software implementation can also be performed by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • a third aspect provides a file system privilege setting device, comprising a processor and an interface, the interface for receiving a request message; the processor for performing the method of the first aspect or any possible implementation of the first aspect .
  • the present invention provides a file system privilege setting method and device, the method being executed by a storage system, including the method being applied to a storage system, including: the storage system receiving a privilege setting request, the privilege setting request being used for Requesting access rights setting for a node on a directory tree of the file system, the permission setting request includes an identifier of the node to be set and a permission record.
  • the storage system After the storage system receives the permission setting request, the storage system acquires the global version parameter of the current record, and updates the global version parameter of the current record to obtain the latest global version parameter.
  • the storage system saves the identifier and the permission record of the node to be set, and uses the latest global version parameter as the permission version number of the node to be set.
  • the global version parameter is incremented or decremented, and each global version parameter represents a permission setting operation of any node of the directory tree.
  • the permission record of the child node of the node to be set is inherited from the authority record after the current permission setting operation of the node to be set.
  • the method for setting a permission of a file system realizes a permission record for quickly setting an access right of a node of a directory tree, and represents a permission setting operation of an arbitrary node of the directory tree by an updated global version parameter, wherein the method
  • the permission record of the child node of the node that sets the permission is inherited from the permission record after the current permission setting operation of the node to be set, so only the permission record of the parent node of the directory tree is set, and the directory corresponding to the parent node is All the files and all subdirectories underneath inherit the permission records of the parent node, and do not traverse all the subdirectories or files under the parent node to set the permission records of each subdirectory or file under the parent node respectively, thereby improving the directory tree.
  • the efficiency of setting access permissions Set the permission record for the parent node, and do not need to repeatedly set the permission record for the subdirectories and files in the directory corresponding to the parent node, which reduces the storage space overhead.
  • FIG. 1 is a schematic structural diagram of a storage system according to an embodiment of the present disclosure
  • FIG. 2 is a schematic structural diagram of a NAS storage system 100 according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of an organization form of a directory tree according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of a method for accessing data according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for setting an access right of a newly added node according to an embodiment of the present invention
  • FIG. 6 is a structural diagram of a device for setting a rights of a file system according to an embodiment of the present invention.
  • FIG. 1 is a schematic structural diagram of a storage system according to an embodiment of the present invention.
  • the storage system may be a network-attached storage (NAS) storage system or a storage area network (SAN) storage system.
  • NAS network-attached storage
  • SAN storage area network
  • the present invention is described by taking a NAS storage system as an example.
  • the user communicates with the NAS storage system 100 through the client.
  • the client can be a terminal device or various types of servers.
  • the NAS storage system provides data to the client through network and file sharing protocols.
  • the protocols used include the Transmission Control Protocol (TCP) protocol for data transmission, the Internet Protocol (IP) protocol, and Network File Service (Common Internet File, CIFS) protocol and Network File System (NFS) protocol.
  • TCP Transmission Control Protocol
  • IP Internet Protocol
  • CIFS Common Internet File
  • NFS Network File System
  • the terminal device of the embodiment of the invention includes a tablet device, a notebook computer, a mobile internet device, a palmtop computer, a desktop computer, a mobile phone or other terminal devices in the form of products.
  • the NAS storage system 100 of the embodiment of the present invention may be a file server, or may be a storage device such as a computer or a desktop computer.
  • the directory tree includes files in the root directory, subdirectories, and subdirectories.
  • the root directory or subdirectories can contain not only files, but also subordinate subdirectories, and so on.
  • the directory tree of the level directory structure is not only files, but also subordinate subdirectories, and so on.
  • the nodes in the directory tree include the mount node, the directory node, and the file node.
  • the directory tree includes a root node, an intermediate node, and a leaf node.
  • the mount node is the root node of the directory tree
  • the directory node is the intermediate node of the directory tree
  • the file node is the leaf node of the directory tree.
  • each node has its own parent when it is a child.
  • each parent node has its own child node when each node acts as a parent node.
  • the subordinate directories and files under the directory corresponding to the parent node belong to the child nodes of the parent node.
  • the path information for each node in the directory tree is used to indicate all nodes on the access branch from the root node of the directory tree to the node.
  • An access branch from the root node to the node is a path from the root node to the node, and a path from the root node to the node may identify a location of the node in a directory tree, and a path in the path The location of all nodes in the directory tree. All subdirectories and files in the directory corresponding to each node in the path belong to different directory levels.
  • the directory level of the directory corresponding to the parent node is higher than the directory level of the directory corresponding to all the child nodes belonging to the parent node, and the path in the path of the node to be accessed is
  • the directory corresponding to the access node has the lowest directory level, and the directory corresponding to the root node has the highest directory level.
  • FIG. 2 is a schematic structural diagram of a NAS storage system 100 according to an embodiment of the present invention.
  • the NAS storage system 100 is used for storage, including the controller 210 and the storage array 220.
  • the controller 210 is configured to receive a request for accessing data by the client, perform authentication according to the received access request, and determine location information of the data to be accessed in the storage array 220 after the authentication is passed, to the storage array 220.
  • the data initiates an access.
  • the controller 210 is also used to set access rights to nodes in the directory tree.
  • the permission record is saved, and the permission record describes the access authority of the client to the node, and the permission record includes an access control item (Access Control Entry, ACE), and the access control item records the access permission type of the node.
  • ACE Access Control Entry
  • the storage array 220 is configured to store data.
  • the controller 210 authenticates the access request, and after the authentication is passed, the controller 210 accesses the data of the node to be accessed.
  • the storage array 220 is also used to store metadata of data.
  • the metadata is data for describing stored data, including standard attribute data, extended attribute data, and layout attribute data.
  • the standard attribute data is used to describe standard attributes such as the size and modification time of the data
  • the layout attribute data is used to describe the storage location of the data
  • the extended attribute data includes data describing the access rights of the node.
  • setting ACL permissions uses traversing all the nodes included in the directory tree to set permissions.
  • This permission setting mechanism takes a long time, affects the efficiency of business processing, and the root directory, subdirectories, and file records included in the directory tree.
  • the same ACL wasting storage space.
  • the embodiment of the present invention is directed to the deficiencies in the prior art. For the case where the files and subdirectories included in the directory tree have the same ACL authority, the following solutions are proposed:
  • the present invention proposes a method for quickly setting ACL permissions of a directory tree.
  • This method only sets the ACL permission of the parent node of the directory tree, and makes all the files and all subdirectories under the directory corresponding to the parent node inherit the ACL permission of the parent node. Since all files and all subdirectories in the directory corresponding to the parent node inherit the ACL permission of the parent node, it is only necessary to set the ACL permission of the parent node, and it is not necessary to traverse all the subdirectories or files under the parent node. Set the ACL permissions of each subdirectory or file under the parent node separately, which improves the efficiency of setting the ACL permissions of the directory tree. By setting the ACL permission on the parent node, you do not need to repeatedly set ACL permissions on the subdirectories and files in the directory corresponding to the parent node, which reduces the storage space overhead.
  • the method for quickly setting the ACL permission of the directory tree provided by the present invention, because all files and all subdirectories under the corresponding directory of the parent node inherit the ACL permission of the parent node, any file under the directory corresponding to the parent node
  • the ACL permission of the parent node with the latest ACL permission is inherited, so the latest ACL permission of the parent node with the latest ACL permission can be used as the ACL of the file or subdirectory to be accessed.
  • the permission information of each node on the tree that is, the permission record of any node on the directory tree is not separately stored in the metadata of the arbitrary node itself, but is uniformly saved by the global ACL.
  • the global ACL saves the global version parameter, and the global ACL indicates the permission version number of the node to be set by the updated value of the global version parameter.
  • the method for quickly setting the ACL permission of the directory tree after the NAS storage system 100 receives the permission setting request, the controller 210 queries the global ACL, obtains the global version parameter, and updates the global version parameter to obtain the current global
  • the version parameter saves the identifier and the permission record of the node to be set, and uses the current global version parameter as the permission version number of the node to be set.
  • the permission setting request is used to request access permission setting for a node on a directory tree of the file system, where the permission setting request includes an identifier of the node to be set and a permission record.
  • the controller 210 includes an interface 211 and an interface 212 for communicating with a client. Interface 212 is used to communicate with storage array 220.
  • the controller 210 further includes a control module 230 for setting access rights of nodes in the directory tree for authenticating the permission records of the access nodes.
  • the control module 230 authenticates the permission record of the access node, and after the authentication is passed, the control module 230 accesses the data of the node to be accessed.
  • the control module 230 includes a processor 213 and a memory 214.
  • the processor 213 is configured to set an access right of a node in the directory tree for authenticating the permission record of the access node.
  • the processor 213 authenticates the permission record of the access node, and after the authentication is passed, the processor 213 accesses the data of the node to be accessed.
  • the memory 214 includes a high speed RAM memory and may also include a non-volatile memory (NVM) such as at least one disk memory. It can be understood that the memory 214 can be a random memory (RAM), a magnetic disk, a hard disk, a solid state disk (SSD), or a non-volatile memory, and can store various program codes. Read the media.
  • NVM non-volatile memory
  • the memory 214 is configured to temporarily store information sent from the client.
  • the processor 213 can be any computing device, and can be a general purpose central processing unit (CPU), a microprocessor, a programmable controller, an application-specific integrated circuit (ASIC), or one or more for control.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the interface 211 is configured to receive a permission setting request sent by the client.
  • the permission setting request is used to request access permission setting for a node on the directory tree of the file system to be set to access.
  • the permission setting request includes an identifier and a permission record of a node in the directory tree to which the access authority is to be set.
  • the permission setting request is used to instruct the processor 213 to update the currently recorded global version parameter to obtain the latest global version parameter.
  • the processor 213 is configured to request, according to the permission setting, a setting of an access right of a node to which the permission is to be set.
  • the processor 213 is configured to obtain a global version parameter of the current record, update the global version parameter of the current record, and obtain the latest global version parameter, where the global version parameter is incremented or decremented, and each global version parameter is used. Represents a permission setting operation for any node of the directory tree.
  • the processor 213 is further configured to save an identifier and a permission record of the node to be set, and use the latest global version parameter as a permission version number of the node to be set, where the The permission record of all child nodes of the node that sets the permission is inherited from the permission record after the current permission setting operation of the node to which the permission is to be set.
  • the privilege setting request may further include path information of the node to which the privilege is to be set, and path information of the node to be set privilege indicates an access branch from the root node to the node to be set privilege All nodes on it.
  • the correspondence between the identifier, the path information, and the authority record of the node whose access authority has been set is saved by setting a global ACL.
  • the global ACL also includes a global version parameter.
  • the global ACL is saved in the metadata of the root node of the directory tree. After the access authority is set to the node, the latest global version parameter is used as the permission version number of the node to be set, so the global ACL can also save the permission version number of the node with the access permission set.
  • the interface 211 is further configured to receive a request for creating a global ACL sent by the client.
  • the request to create a global ACL is used to instruct the processor 213 to create a global ACL, and set an initial global version parameter for the newly created global ACL.
  • the processor 213 is configured to create a global ACL according to the request for creating a global ACL.
  • the global ACL is saved with the global version parameter.
  • the value of the global version parameter in the created global ACL is the initial value.
  • the initial value of the global version parameter is 0. It can also be other values or letters or other symbol identifiers.
  • FIG. 3 is a schematic diagram of an organization form of a directory tree according to an embodiment of the present invention.
  • the directory tree includes a root node 310, an intermediate node 311, an intermediate node 312, a leaf node f1, a leaf node f2, and a leaf node f3.
  • the global ACL created can be represented by Table 1.
  • the global ACL shown in Table 1 includes the global version parameter, which is set for the newly created global ACL.
  • the value of the initial global version parameter is 0 shown in Table 1.
  • the global ACL shown in Table 1 is also used to store the identity of each node of the directory tree of the file system and the path information of each node.
  • the path information of the node includes the identity of each node in the sub-file system, for example, by digitally identifying each node, as shown in Table 1.
  • the root node is identified by the number 310, and the path information of the root node 310 includes the number 310 in the identity of the root node.
  • the global version parameter in the created global ACL, and the identifier of each node in the file system, and the corresponding relationship between the path information of each node are as shown in Table 1.
  • the global ACL can also be used to save the privilege record and privilege version number of the node to which the ACL is to be configured. After the global ACL is created, if the ACL permission is not set for the node of the directory tree, the global ACL is saved. The permission record and permission version number in the space is empty.
  • the node may be identified by the path information of the node, and the global version parameter, and the identifier of each node in the file system, and the correspondence relationship between the path information of each node may be as Table 2 shows.
  • the user sets the access rights of the nodes in the directory tree through the client.
  • the processor 213 is further configured to save the identifier and the permission record of the node to be set to the global ACL, where the permission version number of the node to be set is the value of the updated global version parameter.
  • the processor 213 is further configured to acquire access rights of the to-be-accessed node before accessing data of the node to be accessed.
  • the access right of the node to be accessed is the access right of the node with the latest permission version number among all the nodes indicated by the path information of the node to be accessed to the root node.
  • the node with the latest permission version number indicates the access permission by the permission record, and the permission record of the latest node of the permission version number.
  • the access permission of the node to be accessed is represented as a permission record corresponding to a node having the latest permission version number among all nodes indicated by the path information of the node to be accessed.
  • the storage system organizes access rights data of all nodes of the directory tree through global ACLs.
  • the global ACL stored in the storage array 220 is used to describe the access rights of the node to be set.
  • the global ACL is used to save the value of the updated global version parameter, and is used to save the location.
  • Corresponding relationship between the identifier of the node that sets the permission, the path information, and the permission record, where the permission version number of the node to be set is the value of the updated global version parameter.
  • the identifier, the path information, and the rights record of the node to be set to form a set of correspondences are saved in the global ACL, and only the metadata of the root node of the directory tree can be obtained to obtain the directory tree.
  • the identifier, path information, and permission record of the node to be set up for the permission provide a convenient access channel for obtaining the permission record and path information of the node of the directory tree.
  • FIG. 4 is a flowchart of a method for accessing data according to an embodiment of the present invention.
  • the method for accessing rights provided by this embodiment is performed by the NAS storage system 100 shown in FIG. 2, and may be specifically implemented by the control module 230 in the NAS storage system 100 or the control module 230 shown in FIG.
  • the processor 213 performs a detailed description of how to set access rights to the created directory tree after the directory tree is created, and then access the data of the node to be accessed of the created directory tree, including the following steps. .
  • the NAS storage system 100 receives a request for creating a global ACL sent by the client.
  • the request to create a global ACL is used to instruct the NAS storage system 100 to create a global ACL.
  • the user can send a request to create a global ACL to the NAS storage system 100 through the client.
  • the request to create a global ACL includes an identifier of a root node of the directory tree.
  • the request for creating a global ACL may include path information of each node of the directory tree and an identifier of each node.
  • the path information of each node indicates all nodes on the access branch from the root node to the node, that is, a path for representing the root node to the node, according to which the node can be found in the directory tree. Position, and the position of the intermediate node in the path in the directory tree.
  • Each node except the root node in the path belongs to a parent node, and each node except the leaf node in the path has its own child node.
  • the subdirectories and files at each level in the directory corresponding to each node except the leaf node belong to different directory levels.
  • the request to create a global ACL may include only the path information of each node of the directory tree.
  • the NAS storage system 100 creates a global ACL. Specifically, the NAS storage system 100 creates a global version parameter and saves the global version parameter to the global ACL, where the value of the global version parameter is an initial value.
  • the request for creating a global ACL may include path information of each node of the directory tree and an implementation manner of the identifier of each node, and the NAS storage system 100 saves
  • the correspondence between the path information of each node of the directory tree and the identifier of the node is in the global ACL.
  • the global ACL as shown in Table 3 includes the correspondence between the path information of each node of the directory tree and the identifier of the node.
  • the global ACL shown in Table 3 also includes global version parameters. Based on the directory tree shown in Figure 3, the content of the global ACL created in this step is as shown in Table 3.
  • the global ACL includes the global version parameter and the path information of each node.
  • the NAS storage system 100 receives the permission setting request.
  • the permission setting request is used to request access permission setting for a node on a directory tree of the file system, where the permission setting request includes an identifier of the node to be set and a permission record.
  • the user sends a permission setting request through the client.
  • the permission setting request includes the identification and permission record of the node to which the permission is to be set.
  • the intermediate node 311 is taken as an example of a node to be set.
  • the rights record includes several ACEs, each of which contains control type (type), permission (mask), and user ID (user id).
  • the control type includes allowed or denied, etc.
  • the user id represents a user or a certain type of user, and the mask indicates the access authority of the corresponding user, which is generally represented by a mask.
  • the request for creating a global ACL received by the NAS storage system 100 includes the path information of each node of the directory tree and the identifier of each node
  • the newly created global ACL includes each directory tree.
  • the NAS storage system 100 receives the permission setting request, and saves the permission record of the node to be set to the global ACL, where the node to be set is
  • the identification, path information, and permission records form a set of correspondences.
  • the newly created global ACL does not include the directory tree.
  • An optional implementation manner of the permission setting request in the step S403 of the present invention is that the permission setting request includes not only the identifier of the node to be set, but also the identifier of each node. And the permission record, further including path information of the node to which the permission is to be set, where the path information of the node to which the permission is to be set indicates all nodes on the access branch from the root node to the node to be set.
  • the NAS storage system 100 saves the path information of the node to be set to the global ACL, where the identifier, the path information, and the authority record of the node to be set are formed into a corresponding group. relationship.
  • the newly created global ACL does not include the directory tree.
  • the path information of each node and the identifier of each node an optional implementation manner of the correspondence between the identifier of the node to be set, the path information, and the permission record is saved, and the permission to be set is set.
  • the correspondence between the identifier of the node, the path information, and the permission record is stored in the metadata of the node to which the permission is to be set.
  • the NAS storage system 100 acquires a global version parameter.
  • the NAS storage system 100 can obtain the global version parameter of the current record by querying the global ACL.
  • the global access control list is stored in metadata of a root node of the directory tree, and the global access control list holds a global version parameter. Based on the contents of the global ACL of the directory tree shown in Table 3, it is determined that the value of the created global version parameter is 0 according to the content of the global ACL created by the NAS storage system 100 in step S402.
  • the NAS storage system 100 updates the value of the currently recorded global version parameter to obtain the latest global version parameter.
  • the latest global version parameter is used as the permission version number of the node to be set.
  • the privilege version number of the node to be set up in the present invention may be saved in the global ACL. In other implementation manners, the privilege version number of the node to be set may also be saved in the privilege to be set. In the metadata of the node.
  • the global version parameter is incremented or decremented, and each global version parameter represents a permission setting operation of any node of the directory tree.
  • the NAS storage system 100 updates the value of the global version parameter. Specifically, the value of the global version parameter may be added or subtracted according to a preset granularity. The preset granularity may be 1, and may be other values greater than zero. Specifically, in the present embodiment, after the NAS storage system 100 adds 2 to the value of the global version parameter, the value of the obtained global version parameter is 2.
  • the NAS storage system 100 saves the identifier of the node to be set and the permission record.
  • the permission version number of the node to be set is the value of the updated latest global version parameter.
  • the permission record of the child node of the node to which the permission is to be set is inherited from the authority record after the current permission setting operation of the node to which the permission is to be set.
  • the identifier and the permission record of the node to be set are saved in the global ACL. In other implementation manners, the identifier and the permission record of the node to be set are also saved in the node to be set. In the metadata.
  • the privilege version number of the node to be set is saved in the global ACL. In other implementations, the privilege version number of the node to be set may also be saved in the metadata of the node to be set.
  • the set global ACL includes the value of the updated global version parameter, the identifier of the node to be set, the permission version number of the node to be set, and the permission record.
  • the content of the global ACL is as shown in Table 4.
  • the set global ACL includes a value of the updated global version parameter (2), a permission version number (2) of the node to which the permission is to be set, and the authority record (ACE1, ACE2, ... ACEn).
  • the method for quickly setting the ACL authority of the directory tree proposed by the present invention.
  • the method only sets the ACL authority of the parent node of the directory tree, for example, the ACL authority of the intermediate node 311 in Table 4, then the parent node, such as the intermediate node 311 shown in Table 4, all files and all children in the corresponding directory.
  • the directory for example, the subdirectory corresponding to the intermediate node 312 shown in Table 4 and the file corresponding to the leaf node f1, the leaf node f2, and the leaf node f3, inherit the parent node (the intermediate node 311 shown in Table 4).
  • ACL permissions for example, the subdirectory corresponding to the intermediate node 312 shown in Table 4 and the file corresponding to the leaf node f1, the leaf node f2, and the leaf node f3, inherit the parent node (the intermediate node 311 shown in Table 4).
  • the NAS storage system 100 receives a request to access data.
  • the user sends the request for accessing data through the client.
  • the request for accessing data is used to indicate accessing data of a node to be accessed in the directory tree, and the request for accessing data includes an identifier of a node to be accessed in the directory tree, and the data requested to be accessed belongs to the node to be accessed, and the node to be accessed is Any node of the built-in directory tree. All or part of the nodes in the directory tree are set with permission records. In the present invention, the permission version number of the node for which the permission record is not set defaults to the minimum version number.
  • the NAS storage system 100 confirms the path information of the to-be-accessed node according to the identifier of the to-be-accessed node.
  • the NAS storage system 100 queries the global ACL or the metadata of the to-be-accessed node, and confirms the path information of the to-be-accessed node according to the identifier of the to-be-accessed node.
  • the path information of the to-be-accessed node is used to indicate the to-be-accessed node and all the parent nodes of the to-be-accessed node.
  • the global ACL needs to be queried to obtain the access rights of the to-be-accessed node to which the data belongs.
  • the NAS storage system 100 queries the permission version number of each node of all the nodes indicated by the path information, confirms the node with the latest version number, and obtains the permission record of the node with the latest version number. Access access to the node.
  • the authority of the latest node of the permission version number acquired by the NAS storage system 100 is recorded as the access right of the node to be accessed.
  • the permission version number of the to-be-accessed node is the latest among the permission version numbers of the to-be-accessed node and all the parent nodes of the to-be-accessed node
  • the access permission of the to-be-accessed node is the recorded a permission record of the to-be-accessed node, where the permission version number of the to-be-accessed node is not the latest among the to-be-accessed node and the permission version number of all the parent nodes of the to-be-accessed node, the to-be-accessed node
  • the access rights are inherited from the permission records corresponding to the parent node of the node to be accessed that has the latest permission version number.
  • the NAS storage system 100 queries the privilege version number of each node in the path, and the node with the largest privileged version number is the node with the latest privilege version number. .
  • the access rights of all or part of the nodes in the directory tree are set, and the access rights of the nodes are described by the authority records.
  • the querying the privilege version number of each node indicated by the path information of the to-be-accessed node, and confirming the latest node with the privilege version number specifically, the NAS storage system 100 compares the traversal rules according to a preset traversal rule.
  • the permission version number of each node indicated by the path information of the access node is referred to, and the node with the latest version number of the permission is confirmed.
  • all the nodes indicated by the path information of each node in the directory tree belong to different directory levels, and the directory level of the parent node in all nodes indicated by the path information of each node in the directory tree.
  • the directory level of the node to be accessed is the lowest among all the nodes indicated by the path information of the node to be accessed, and the directory level of the root node is the highest.
  • the NAS storage system 100 compares the permission version number of each node indicated by the path information of the node to be accessed according to a preset traversal rule, and confirms that the node with the latest version number of the permission version is from the Starting from the root node, each time selecting and comparing the permission version numbers of two nodes in all the nodes indicated by the path information of the to-be-accessed node, confirming the node with the latest version number of the permission; according to the order of the directory level from highest to lowest When the traversal is compared to the to-be-accessed node among all the nodes indicated by the path information of the node to be accessed, the node with the latest privilege version number is the node with the latest privilege version number.
  • each time selecting and comparing the permission version numbers of two nodes in all the nodes indicated by the path information of the to-be-accessed node, confirming the latest node with the permission version number specifically, from the node Starting, selecting, according to the directory level from high to low, selecting one current node among all the nodes indicated by the path information of the to-be-accessed node, and selecting each node from the node information indicated by the path information of the to-be-accessed node
  • a node to be compared lower than the directory level of the current node compares the current node and the node to be compared with the permission version number, and confirms the node with the latest version number.
  • the latest node whose confirmed permission version number is the permission version
  • the latest node specifically, when the permission version number of the current node is the node with the latest permission version number, the current node continues to be the current node, and all the nodes indicated by the path information of the to-be-accessed node are A node lower than the directory level of the node to be compared is selected as a new node to be compared, and the current node and the new node to be compared are compared with a permission version number.
  • the node to be compared is selected as the new current node, and one of the nodes indicated by the path information of the node to be accessed is selected.
  • the new lower-level node of the current node is used as a new node to be compared, and the comparison of the permission version numbers is performed until the permission version number of the to-be-accessed node of the directory tree is compared.
  • the current node is the node with the latest version number.
  • the current node is regarded as the current node and the node with the latest version number of the permission to be compared, and then continues
  • the current node is a current node, and a node lower than a directory level of the node to be compared is selected as a new node to be compared from all the nodes indicated by the path information of the node to be accessed, and the current node is used. And comparing the privilege version number with the new node to be compared, until the privilege version number of the to-be-accessed node of the directory tree is compared, the confirmed current node is the node with the latest privilege version number.
  • the NAS storage system 100 compares the permission version number of each node indicated by the path information of the node to be accessed according to a preset traversal rule, and confirms that the latest version of the node with the latest version number is Starting to access the node, each time selecting and comparing the permission version numbers of two nodes in all the nodes indicated by the path information of the to-be-accessed node, confirming the node with the latest version number of the permission; according to the directory level from low to high In order, until the root node of all the nodes indicated by the path information of the node to be accessed is traversed, the node with the latest authorized version number is the node with the latest version number.
  • each time selecting and comparing the permission version numbers of two of the nodes indicated by the path information of the node to be accessed, confirming the node with the latest version number of the permission specifically, from the Starting from the access node, selecting one current node among all the nodes indicated by the path information of the to-be-accessed node, in descending order of the directory level, each time from all the nodes indicated by the path information of the to-be-accessed node Selecting a node to be compared one level higher than the directory level of the current node, comparing the current node and the node to be compared with the version number of the permission, and confirming the node with the latest version number.
  • the latest node with the confirmed permission version number is the latest node with the permission version number.
  • the privilege version number of the current node is the node with the latest privilege version number
  • the current node continues to be the current node, and one of the nodes indicated by the path information of the to-be-accessed node is selected.
  • the node that is higher than the directory level of the comparison node is regarded as a new node to be compared, and the current node and the new node to be compared are compared with the permission version number.
  • the node to be compared is selected as the new current node, and one of the nodes indicated by the path information of the node to be accessed is selected.
  • a new node of the current node's directory level is regarded as a new node to be compared, and the permission version number is compared until the permission version number of the root node of the directory tree is compared, and the current current confirmation is performed.
  • the node is the node with the latest version number.
  • the current node is regarded as the current node and the node with the latest version number of the permission to be compared, and then continues
  • the current node is a current node, and a node higher than a directory level of the node to be compared is selected as a new node to be compared from all the nodes indicated by the path information of the node to be accessed, and the current node is used. And comparing the privilege version number with the new node to be compared until the privilege version number of the root node of the directory tree is compared, and the confirmed current node is the node with the latest privilege version number.
  • the NAS storage system 100 performs authentication according to the access permission of the to-be-accessed node. After the authentication is passed, the client accesses the data of the to-be-accessed node.
  • the access right of the node to be accessed is the access right of the node with the latest permission version number among all the nodes indicated by the path information of the node to be accessed to the root node.
  • the NAS storage system 100 queries the permission version number of each node of all the nodes indicated by the path information, and confirms After the latest version of the privilege version number and the privilege record of the latest node of the privilege version number, the NAS storage system 100 can save the ACL version number and authority record of the node to be accessed to the global ACL.
  • the access permission version number of the node to be accessed is the latest permission version number confirmed in step S409
  • the authority record of the node to be accessed is the permission record of the node with the latest permission version number confirmed in step S409.
  • the NAS storage system 100 configures a global ACL identifier for each of a plurality of directory trees including different root nodes.
  • the identifier of the global ACL includes an identifier of a root node of the directory tree, and multiple directory trees including different root nodes are distinguished by identifiers of different root nodes. Therefore, different global ACLs corresponding to multiple directory trees including different root nodes can be distinguished by the identifier of the root node of the directory tree.
  • the identifier of the global ACL may also be a combination of the identifier of the root node of the directory tree and the version information of the global ACL.
  • the version information of the global ACL is used to identify multiple versions of the global ACL including the directory tree of the root node. After the child node is added to the directory tree or the child node is reduced, the NAS storage system 100 backs up the global ACL of the directory tree before the change, so the file system has multiple versions corresponding to multiple directory trees including the same root node, including the same version.
  • Multiple versions corresponding to multiple directory trees of the root node include a global ACL version before the node is added to the directory tree, or a global ACL version updated after the node is added to the directory tree, or the directory tree reduces the global ACL version before the node, or is reduced.
  • step S402 that is, after the global ACL is created, or after the directory tree has been created, when the user needs to change the directory tree in which the ACL has been created or the directory tree in which the global ACL is not created, for example,
  • the present invention provides a method for setting access rights, and setting access rights for newly added directory nodes or file nodes.
  • the following is a detailed description of a method for adding a new node to an existing directory tree, and how to set the access authority of the newly added node.
  • FIG. 5 is a new node according to an embodiment of the present invention. The method for setting the access authority is as shown in FIG. 5.
  • the method for setting the access authority of the newly added node provided by the embodiment is performed by the NAS storage system 100 shown in FIG. 2, and may be specifically stored by the NAS.
  • the control module 230 in the system 100 or the processor 213 in the control module 230 shown in FIG. 2 is executed, and specifically includes the following steps.
  • the NAS storage system 100 receives a request to create a node.
  • the user can send a request to create a node to the NAS storage system 100 through the client.
  • the request to create a node includes the identification and path information of the newly added node of the directory tree, and the path information of the newly added node indicates all nodes on the access branch from the root node to the newly added node.
  • the newly added node can be a directory node or a file node. For example, based on the directory tree shown in Figure 3, the newly added node has the ID 313 and the path is ⁇ 310 ⁇ 311 ⁇ 313. Based on the path of the newly added node, it is determined that the newly added node is a newly added child node 313 under the intermediate node 311.
  • the identifier of the global ACL of the directory tree is updated to include the identifier of the newly added root node.
  • the root node before the root node is added to the root node is changed to the child node of the newly added root node.
  • the request to create the node may include only the path of the newly added node. Because the path of the newly added node includes the identity of each node in the path. The identifier of the newly added node may be determined according to the path of the newly added node.
  • the NAS storage system 100 After the NAS storage system 100 receives the request for creating a node sent by the client, the NAS storage system 100 can back up the current global ACL, so that the user can restore the access rights of the directory tree according to different global ACL versions.
  • the NAS storage system 100 stores the correspondence between the identifier of the newly added node and the path information.
  • the NAS storage system 100 saves the correspondence between the identifier of the newly added node and the path information to the global ACL.
  • the NAS storage system 100 saves the correspondence between the identifier of the newly added node and the path information to the metadata of the newly added node.
  • the NAS storage system 100 saves the path information of the newly added node to the global ACL or the newly added node. In the metadata. Therefore, in the implementation manner in which the path information of the node is represented by the identifier of each node, the node can be identified by the path, thereby saving the storage space of the global ACL.
  • the NAS storage system 100 saves the permission version number of the newly added node to the global ACL.
  • the value of the permission version number of the newly added node is the initial value of the preset permission version number.
  • the NAS storage system 100 saves the permission version number of the newly added node to the global ACL.
  • the NAS storage system 100 saves the permission version number of the newly added node to the metadata of the newly added node.
  • the initial value of the preset authority version number is set to zero.
  • the initial value of the preset permission version number of the newly added node is less than or equal to the initial value of the global version parameter. Because the permission version number of the newly added node is less than or equal to the initial value of the global version parameter, the permission version number of the node with the access permission set in all the nodes indicated by the path information of the newly added node is newer than the newly added The node's permission version number is new. Therefore, the newly added node inherits the access rights of the latest node of the permission version number of all the nodes indicated by the path information of the newly added node, so the setting of the access authority for the newly added node does not need to be stored.
  • the access record of the access rights of the newly added node improves the setting efficiency of the access rights of the newly added nodes, and saves the storage overhead of the access rights of the newly added nodes.
  • the content of the global ACL is updated in the directory tree of the newly added node through steps S520 and S530.
  • the content of the updated global ACL is as shown in Table 5.
  • the content of the global ACL is as shown in Table 6 after the access authority is set by the step shown in FIG. 5 above. Shown.
  • the request to create a node further includes data included in the newly added node, and after step S510, the NAS storage system 100 saves the data to the storage array 220.
  • FIG. 6 is a structural diagram of a device for setting a rights of a file system according to an embodiment of the present disclosure.
  • the device for setting a rights of a file system according to an embodiment of the present invention is applied to a storage system, for example, the NAS can be applied to the NAS.
  • the rights setting device 60 of the file system provided in this embodiment includes: a receiving module 61, an obtaining module 62, and a processing module 63.
  • the receiving module 61 is connected to the obtaining module 62
  • the processing module 63 is connected to the obtaining module 62 and the receiving module 61, respectively.
  • the receiving module 61 is configured to receive a permission setting request, where the permission setting request is used to request access permission setting on a node in a directory tree of the file system, where the permission setting request includes an identifier of a node to be set And permission records.
  • the receiving module 61 receives the function of the permission setting request sent by the client, and can be implemented by the interface 211 in the NAS storage system 100.
  • the receiving module 61 receives the function of the permission setting request sent by the client, and can be implemented by the interface 211 in the NAS storage system 100.
  • the specific step S403 shown in FIG. 4 The details are not repeated here.
  • the obtaining module 62 is configured to obtain a global version parameter of the current record.
  • the function of the acquisition module 62 to obtain the currently recorded global version parameter may be implemented by the interface 212 in the NAS storage system 100, or may be implemented by the processor 213 or the control module 230 in the NAS storage system 100.
  • the specific implementation details of the global version parameter of the current record are obtained. For details, refer to the specific details of step S404 shown in FIG. 4, and details are not described herein again.
  • the processing module 63 is configured to update the currently recorded global version parameter, obtain the latest global version parameter, and save the identifier and the authority record of the node to be set.
  • the latest global version parameter is used as the permission version number of the node to be set.
  • the global version parameter is incremented or decremented, and each global version parameter represents a permission setting operation of any node of the directory tree, and the permission record of the child node of the node to be set is inherited from the node of the to-be-set permission The permission record after the current permission setting operation.
  • the processing module 63 updates the currently recorded global version parameter, and the function of obtaining the latest global version parameter may be implemented by the processor 213 or the control module 230 in the NAS storage system 100, and the processing module 63
  • the global version of the current record is updated to obtain the specific implementation details of the latest global version parameter. For details, refer to step S405 shown in FIG. 4, and details are not described herein again.
  • the function of the node and the permission record of the node to be set by the processing module 63 can be implemented by the processor 213 or the control module 230 in the NAS storage system 100, and the processing module 63 saves the permission to be set.
  • the processing module 63 saves the permission to be set.
  • the permission setting device of the file system realizes the permission record of quickly setting the access authority of the node of the directory tree, and represents the one permission setting operation of any node of the directory tree by the updated global version parameter, the permission to be set
  • the permission record of the child node of the node inherits the permission record after the current permission setting operation of the node to be set, so only the permission record of the parent node of the directory tree is set, and all files under the directory corresponding to the parent node are made.
  • all subdirectories inherit the permission records of the parent node, and do not traverse all the subdirectories or files under the parent node to respectively set the permission records of each subdirectory or file under the parent node, thereby improving the access permission of the directory tree.
  • Set efficiency Set the permission record for the parent node, and do not need to repeatedly set the permission record for the subdirectories and files in the directory corresponding to the parent node, which reduces the storage space overhead.
  • the obtaining module 62 is further configured to query a global access control list, and obtain a global version parameter of the current record, where the global access control list saves metadata of a root node of the directory tree.
  • the global access control list saves the global version parameter.
  • the function of obtaining the global version of the current ACL is obtained by the obtaining module 62, and may be implemented by the interface 212 in the NAS storage system 100 or by the processor 213 in the NAS storage system 100 or
  • the control module 230 implements the query module 62 to query the global access control list, and obtains the specific implementation details of the global version parameter of the current record. For details, refer to the specific details of step S404 shown in FIG. 4, and details are not described herein again.
  • the processing module 63 is further configured to create a global access control list, and set an initial global version parameter for the newly created global access control list.
  • the processing module 63 creates a global access control list and sets an initial global version parameter for the newly created global access control list, which can be implemented by the processor 213 or the control module 230 in the NAS storage system 100.
  • the processing module 63 creates a global access control list, and sets specific implementation details of the initial global version parameters for the newly created global access control list. For details, refer to the specific details of steps S401 and S402 shown in FIG. Narration.
  • the permission setting request further includes path information of the node to which the permission is to be set, and path information of the node to be set to the permission indicates the permission from the root node to the to-be-set permission All nodes on the node's access branch.
  • the processing module 63 is further configured to save path information of the node to be set to the global access control list. The identifier, the path information, and the authority record of the node to be set to form a set of correspondences.
  • the function of the processing module 63 to save the path information of the node to be set to the global access control list may be implemented by the processor 213 or the control module 230 in the NAS storage system 100, and the processing module 63
  • the path information of the node to be set to the global access control list refer to the specific details of the path information about the node that saves the directory tree in step S403 shown in FIG. 4, where not Let me repeat.
  • the identifier of the node to be set, the path information, and the authority record form a set of correspondences, and are saved in the global access control list, only the metadata of the root node of the index tree can be obtained.
  • the identifier, path information, and permission record of the node to be set in the directory tree provide a convenient access path for obtaining the permission record and path information of the node of the directory tree.
  • the receiving module 61 is further configured to receive a request for accessing data, where the request for accessing data includes an identifier of a node to be accessed.
  • the function of the receiving module 61 to receive the request for accessing the data sent by the client may be implemented by using the interface 211 in the NAS storage system 100.
  • the function of the receiving module 61 to receive the request for accessing the data sent by the client may be implemented by using the interface 211 in the NAS storage system 100.
  • the specific implementation of the request for accessing the data refer to step S407 shown in FIG. 4 . The specific details are not repeated here.
  • the obtaining module 62 is further configured to acquire an access right of the to-be-accessed node according to the identifier of the to-be-accessed node.
  • the access permission of the to-be-accessed node is recorded when the permission version number of the to-be-accessed node is the latest among the permission version numbers of the to-be-accessed node and all the parent nodes of the to-be-accessed node.
  • the permission record of the to-be-accessed node when the permission version number of the to-be-accessed node is not the latest among the to-be-accessed node and the permission version number of all the parent nodes of the to-be-accessed node, the to-be-accessed The access permission of the node is inherited from the permission record corresponding to the parent node of the node to be accessed that has the latest permission version number.
  • the function of acquiring the access authority of the to-be-accessed node by the obtaining module 62 according to the identifier of the to-be-accessed node may be implemented by using the interface 212 in the NAS storage system 100 or by using the NAS storage system 100.
  • the processor 213 or the control module 230 is implemented, and the obtaining module 62 obtains the specific implementation details of the access rights of the to-be-accessed node according to the identifier of the to-be-accessed node, and may refer to specific details of steps S408 and S409 shown in FIG. 4, I will not repeat them here.
  • the processing module 63 is further configured to perform authentication according to the access authority of the to-be-accessed node, and access the data of the to-be-accessed node after the authentication is passed.
  • the processing module 63 performs authentication according to the access right of the node to be accessed.
  • the function of accessing the data of the node to be accessed may be through the processor 213 in the NAS storage system 100 or The control module 230 is implemented, and the processing module 63 performs authentication according to the access right of the node to be accessed.
  • the specific implementation details of the data of the node to be accessed may be referred to step S410 shown in FIG. 4 . The details will not be described here.
  • the obtaining module 62 is further configured to query the global access control list, and confirm the path information of the to-be-accessed node according to the identifier of the to-be-accessed node, and query the to-be-accessed The permission version number of each node indicated by the path information of the node, confirming the latest node with the permission version number, and obtaining the permission record of the latest node of the permission version number.
  • the path information of the to-be-accessed node is used to indicate the to-be-accessed node and all the parent nodes of the to-be-accessed node, and the permission of the latest node of the permission version number is recorded as the access right of the to-be-accessed node.
  • the obtaining module 62 queries the global access control list, and the function of confirming the path information of the node to be accessed may be implemented by the storage array 220 in the NAS storage system 100 according to the identifier of the node to be accessed.
  • the obtaining module 62 queries the global access control list, and confirms the path of the to-be-accessed node according to the identifier of the to-be-accessed node, and is implemented by the controller 210 or the processor 213 or the control module 230 in the NAS storage system 100.
  • step S408 shown in FIG. 4, and details are not described herein again.
  • the obtaining module 62 queries the permission version number of each node indicated by the path information of the node to be accessed, and confirms that the function of the node with the latest version number can be implemented by the storage array 220 in the NAS storage system 100. It can also be implemented by the controller 210 or the processor 213 or the control module 230 in the NAS storage system 100. The obtaining module 62 queries the permission version number of each node indicated by the path information of the node to be accessed, and confirms that the permission version number is the latest. For specific implementation details of the node, reference may be made to the specific details of step S409 shown in FIG. 4, and details are not described herein again.
  • the function of the acquisition module 62 to obtain the authority record of the node with the latest permission version number may be implemented by the interface 212 in the NAS storage system 100, or may be through the processor 213 or the control module in the NAS storage system 100. 230 implementation.
  • the specific implementation details of the privilege record of the node with the latest privilege version number are obtained by the obtaining module 62. For details, refer to the specific details of step S409 shown in FIG. 4, and details are not described herein again.
  • the various modules and components of the present invention may be inherited or separately.
  • the obtaining module 62 is further configured to compare a permission version number of each node indicated by the path information of the to-be-accessed node according to a preset traversal rule, and confirm that the permission version number is the latest. node.
  • the traversal rule may be preset according to the access authority distribution rule of the node in the directory tree. And comparing the permission version number of each node in the path of the to-be-accessed node by a suitable preset traversal rule, confirming the node with the latest version number of the permission, and improving the efficiency of the traversal comparison.
  • the obtaining module 62 compares the permission version number of each node indicated by the path information of the node to be accessed according to a preset traversal rule, and confirms that the function of the node with the latest version number can pass the NAS storage system 100.
  • the storage array 220 is implemented by the controller 210 or the processor 213 or the control module 230 in the NAS storage system 100.
  • the obtaining module 62 compares the path information of the node to be accessed according to a preset traversal rule. For details of the specific implementation of the node with the latest version of the privilege version number, refer to the specific details of step S409 shown in FIG. 4, and details are not described herein again.
  • all the nodes indicated by the path information of each node in the directory tree belong to different directory levels, and all nodes in the path information indicated by the path information of each node in the directory tree
  • the directory level of the parent node is higher than the directory level of the child node belonging to the parent node, the directory level of the node to be accessed is the lowest, and the directory level of the root node is the highest.
  • the obtaining module 62 is further configured to: start from the root node, select and compare the permission version numbers of two nodes in all the nodes indicated by the path information of the to-be-accessed node, and confirm the latest node with the permission version number. According to the directory level from high to low, until the traversal comparison to the to-be-accessed node, the latest node with the confirmed permission version number is the node with the latest permission version number.
  • the obtaining module 62 starts from the root node, selects and compares the permission version numbers of two nodes in all the nodes indicated by the path information of the to-be-accessed node, and confirms the latest node with the permission version number. According to the directory level from high to low, until the traversal comparison to the to-be-accessed node, the function that the latest node with the confirmed permission version number is the latest node of the permission version number can pass through the NAS storage system 100.
  • the storage array 220 is implemented by the controller 210 or the processor 213 or the control module 230 in the NAS storage system 100.
  • the obtaining module 62 starts from the root node and selects and compares the path of the node to be accessed each time.
  • the permission version number of the two nodes in all the nodes indicated by the information confirming the latest node with the permission version number, according to the directory level from high to low, until the traversal comparison to the to-be-accessed node, the confirmed permission version
  • step S409 shown in FIG. Details not repeat them here.
  • all the nodes indicated by the path information of each node in the directory tree belong to different directory levels, and all nodes in the path information indicated by the path information of each node in the directory tree
  • the directory level of the parent node is higher than the directory level of the child node belonging to the parent node, the directory level of the node to be accessed is the lowest, and the directory level of the root node is the highest.
  • the obtaining module 62 is further configured to: start from the node to be accessed, select and compare the permission version numbers of two nodes in all the nodes indicated by the path information of the to-be-accessed node, and confirm the latest version of the permission version number.
  • the node according to the directory level from low to high, until the traversal comparison to the root node, the latest node with the confirmed permission version number is the node with the latest permission version number.
  • the obtaining module 62 starts from the node to be accessed, and selects and compares the permission version numbers of two nodes in all the nodes indicated by the path information of the node to be accessed each time, and confirms that the permission version number is the latest. Nodes, according to the directory level from low to high, until the traversal comparison to the root node, the function of the latest node whose confirmed permission version number is the latest version of the permission version number can pass through the NAS storage system 100.
  • the storage array 220 is implemented by the controller 210 or the processor 213 or the control module 230 in the NAS storage system 100.
  • the obtaining module 62 starts from the node to be accessed, and selects and compares the path of the node to be accessed each time.
  • the permission version number of the two nodes in all the nodes indicated by the information confirming the latest node with the permission version number, according to the directory level from low to high, until the traversal comparison to the root node, the confirmed permission version number is the latest
  • step S409 shown in FIG. Details not repeat them here.
  • the receiving module 61 is further configured to receive a request for creating a node.
  • the request for creating a node includes the identifier and path information of the newly added node of the directory tree, and the path information of the newly added node indicates all the access branches from the root node to the newly added node. node.
  • the receiving module 61 receives the function of the request for creating a node sent by the client, and can be implemented by using the interface 211 in the NAS storage system 100.
  • the request for creating a node For specific implementation details of the request for creating a node, refer to step S510 shown in FIG. 5 . The specific details are not repeated here.
  • the processing module 63 is further configured to save a correspondence between the identifier of the newly added node and the path information of the directory tree to the global access control list, and save the permission version number of the newly added node to In the global access control list.
  • the initial value of the privilege version number of the newly added node is less than or equal to the initial value of the created global version parameter, and the initial privilege version number is set for the newly added node, and the initial setting of the newly added node is set.
  • the permission version number is less than or equal to the initial global version parameter.
  • the processing module 63 saves the corresponding relationship between the identifier of the newly added node and the path information of the directory tree to the global access control list, and may pass the processor 213 in the NAS storage system 100. Or the control module 230 is implemented, the processing module 63 saves the correspondence between the identifier of the newly added node and the path information of the directory tree to specific implementation details in the global access control list, and may refer to the steps shown in FIG. The specific details of S520 will not be described here.
  • the function of the processing module 63 to save the permission version number of the newly added node to the global access control list may be implemented by the processor 213 or the control module 230 in the NAS storage system 100, and the processing module 63
  • the processing module 63 For details of the implementation of the privilege version number of the newly added node to the global ACL, refer to the specific details of step S530 shown in FIG. 5, and details are not described herein again.
  • the present invention provides a file system privilege setting method and device, the method being executed by a storage system, including the method being applied to a storage system, including: the storage system receiving a privilege setting request, the privilege setting request being used for Requesting access rights setting for a node on a directory tree of the file system, the permission setting request includes an identifier of the node to be set and a permission record.
  • the storage system After the storage system receives the permission setting request, the storage system acquires the global version parameter of the current record, and updates the global version parameter of the current record to obtain the latest global version parameter.
  • the storage system saves the identifier and the permission record of the node to be set, and uses the latest global version parameter as the permission version number of the node to be set.
  • the global version parameter is incremented or decremented, and each global version parameter represents a permission setting operation of any node of the directory tree.
  • the permission record of the child node of the node to be set is inherited from the authority record after the current permission setting operation of the node to be set.
  • the method for setting a permission of a file system realizes a permission record for quickly setting an access right of a node of a directory tree, and represents a permission setting operation of an arbitrary node of the directory tree by an updated global version parameter, wherein the method
  • the permission record of the child node of the node that sets the permission is inherited from the permission record after the current permission setting operation of the node to be set, so only the permission record of the parent node of the directory tree is set, and the directory corresponding to the parent node is All the files and all subdirectories underneath inherit the permission records of the parent node, and do not traverse all the subdirectories or files under the parent node to set the permission records of each subdirectory or file under the parent node respectively, thereby improving the directory tree.
  • the efficiency of setting access permissions Set the permission record for the parent node, and do not need to repeatedly set the permission record for the subdirectories and files in the directory corresponding to the parent node, which reduces the storage space overhead.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Storage Device Security (AREA)

Abstract

本发明实施例提供一种文件系统的权限设置方法及装置，实现快速设置目录树的节点的访问权限的权限记录，通过更新的全局版本参数表示所述目录树的任意节点的一次权限设置操作。该方法中，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录，所以仅设置目录树的父节点的权限记录，并使父节点对应的目录下的所有文件及所有子目录都继承所述父节点的权限记录。不用遍历父节点下的所有子目录或者文件来分别设置父节点下的每一个子目录或者文件的权限记录，提高目录树的访问权限的设置效率。对父节点设置权限记录，不用对父节点对应的目录下的子目录以及文件重复设置权限记录，减少存储空间的开销。

Description

一种文件系统的权限设置方法及装置 技术领域
本发明实施例涉及文件系统领域，尤其涉及一种文件系统的权限设置方法及装置。
背景技术
文件系统是一个结构化的数据存储和组织形式。一个文件系统被挂载后才能使用，文件系统的组织结构表现为树状结构的目录树，目录树包括根目录、子目录以及子目录下的文件，子目录中不但可以包含文件，而且还可以包含下一级子目录，以此类推构成了多级目录结构的目录树。树状结构的根就是一个挂载点，在目录树中，根目录位于目录树的根节点，文件位于目录树的叶子节点，子目录位于目录树的中间节点。每个文件和目录分别为一个待访问的对象，在访问终端设备或应用程序需要访问的节点之前，查询待访问节点的访问控制列表(Access Control Lists，ACL)，获取访问权限后，访问待访问节点的数据。为控制不同访问设备对不同节点的访问权限，为每一个节点分别配置一个访问控制列表，以分别配置每一个节点的访问权限。具体的，每一个节点的ACL包括若干个访问控制项(Access Control Entry，ACE)，所述访问控制项用于记录所述节点的访问权限类型，并用于记录对所述节点进行访问的访问设备，以及所述访问设备对所述节点的访问权限等内容。
现有的目录树的节点的ACL设置方式为，对目录树的任一节点设置ACL后，再对目录树的与所述任一节点具有相同访问权限的所有节点设置ACL，如此对目录树的每个节点进行ACL的重复设置，节点的访问权限的设置效率较低。
发明内容
本发明公开了一种文件系统的权限设置方法及装置，所述文件系统的权限设置方法减少了节点的ACL的设置开销和存储开销。
第一方面提供一种文件系统的权限设置方法，所述方法应用于存储系统，包括：所述存储系统接收权限设置请求，所述权限设置请求用于请求对文件系统的目录树上的节点进行访问权限设置，所述权限设置请求包括待设置权限的节点的标识和权限记录。所述存储系统接收权限设置请求后，所述存储系统获取当前记录的全局版本参数，对所述当前记录的全局版本参数进行更新，得到最新的全局版本参数。所述存储系统保存所述待设置权限的节点的标识和权限记录，并将所述最新的全局版本参数作为所述待设置权限的节点的权限版本号。其中，全局版本参数递增或者递减设置，每个全局版本参数表示所述目录树的任意节点的一次权限设置操作。其中，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录。
本发明提供的文件系统的权限设置方法，实现快速设置目录树的节点的访问权限的权限记录，通过更新的全局版本参数表示所述目录树的任意节点的一次权限设置操作，该方法中，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录，所以仅设置目录树的父节点的权限记录，并使父节点对应的目录下的所有文件及所有子目录都继承所述父节点的权限记录，不用遍历父节点下的所有子目录或者文件来分别设置父节点下的每一个子目录或者文件的权限记录，提高了目录树的访问权限的设置效率。对父节点设置权限记录，不用对父节点对应的目录下的子目录以及文件重复设置权限记录，减少了存储空间的开销。
基于第一方面，在第一种实现方式中，所述获取当前记录的全局版本参数，包括：查询全局访问控制列表，获取当前记录的全局版本参数，所述全局访问控制列表保存在所述目录树的根节点的元数据中，所述全局访问控制列表保存有所述全局版本参数。
基于第一方面的第一种实现方式，在第二种实现方式中，所述接收权限设置请求之前，还包括：所述存储系统创建全局访问控制列表，并为所述新创建的全局访问控制列表设置初始全局版本参数。
基于第一方面的第一种或第二种实现方式，在第三种实现方式中，所述权限设置请求还包括所述待设置权限的节点的路径信息，所述待设置权限的节点的路径信息指示从所述根节点到所述待设置权限的节点的访问分支上的所有节点，所述方法还包括：所述存储系统保存所述待设置权限的节点的路径信息至所述全局访问控制列表，其中，所述待设置权限的节点的标识、路径信息和权限记录形成一组对应关系。由于所述待设置权限的节点的标识、路径信息和权限记录形成一组对应关系，且被保存在所述全局访问控制列表中，则只需索引目录树的根节点的元数据就可以获取到目录树的待设置权限的节点的标识、路径信息和权限记录，为获取目录树的节点的权限记录和路径信息提供了简便的访问通道。
基于第一方面或第一方面的第一种至第三种实现方式中的任一种实现方式，在第四种实现方式中，所述方法还包括：所述存储系统接收访问数据的请求，所述访问数据的请求包括待访问节点的标识。所述存储系统根据所述待访问节点的标识，获取所述待访问节点的访问权限。其中，在所述待访问节点的权限版本号不是所述待访问节点的路径信息所指示的全部节点所具备的权限版本号中最新的时，所述待访问节点的访问权限继承自所述待访问节点的具备最新权限版本号的父节点所对应的权限记录。所述存储系统依据所述待访问节点的访问权限进行鉴权，当鉴权通过后，访问所述待访问节点的数据。
基于第一方面的第四种实现方式，在第五种实现方式中，在所述待访问节点的权限版本号是所述待访问节点的路径信息所指示的全部节点所具备的权限版本号中最新的时，所述待访问节点的访问权限为记录的所述待访问节点的权限记录。
基于第一方面的第五种实现方式，在第六种实现方式中，所述根据所述待访问节点的标识，获取所述待访问节点的访问权限，包括：所述存储系统查询所述全局访问控制列表，根据所述待访问节点的标识，确认所述待访问节点的路径信息，其中，所述待访问节点的路径信息用于指示所述待访问节点和所述待访问节点的所有父节点。所述存储系统查询所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点。所述存储系统获取所述权限版本号最新的节点的权限记录，所述权限版本号最新的节点的权限记录为所述待访问节点的访问权限。
基于第一方面的第六种实现方式，在第七种实现方式中，所述查询所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点，包括：按照预设的遍历规则，比较所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点。通过预设的遍历规则比较所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点，可以依据目录树中的节点的访问权限分布规律预先设定遍历规则，以通过合适的预设的遍历规则比较所述待访问节点的路径中的每一个节点的权限版本号，确认权限版本号最新的节点，提高遍历比较的效率。
基于第一方面的第七种实现方式，在第八种实现方式中，所述目录树中的每个节点的路径信息指示的所有节点分别属于不同的目录级别，所述目录树中的每个节点的路径信息指示的所有节点中的父节点的目录级别高于所属于所述父节点的子节点的目录级别，所述待访问节点的目录级别最低，根节点的目录级别最高，所述按照预设的遍历规则，比较所述待访问节点的路径信息指示的所有节点中的每一个节点的权限版本号，确认权限版本号最新的节点，包括：所述存储系统从所述根节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点。所述存储系统依据所述目录级别从高至低的顺序，直至遍历比较至所述待访问节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点。
基于第一方面的第七种实现方式，在第九种实现方式中，所述目录树中的每个节点的路径信息指示的所有节点分别属于不同的目录级别，所述目录树中的每个节点的路径信息指示的所有节点中的父节点的目录级别高于所属于所述父节点的子节点的目录级别，所述待访问节点的目录级别最低，所述根节点的目录级别最高，所述按照预设的遍历规则，比较所述待访问节点的路径信息指示的所有节点中的每一个节点的权限版本号，确认权限版本号最新的节点，包括：所述存储系统从所述待访问节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点。所述存储系统依据所述目录级别从低至高的顺序，直至遍历比较至所述根节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点。
基于第一方面的第一种至第九种实现方式中的任一实现方式，在第十种实现方式中，所述方法还包括：所述存储系统接收创建节点的请求，所述创建节点的请求包括所述目录树的新增的节点的标识和路径信息，所述新增的节点的路径信息指示从所述根节点到所述新增的节点的访问分支上的所有节点。所述存储系统保存所述目录树的所述新增的节点的标识和路径信息的对应关系至所述全局访问控制列表中。所述存储系统保存所述新增的节点的权限版本号至所述全局访问控制列表中，所述新增的节点的权限版本号的初始值小于或等于创建的所述全局版本参数的初始值，为所述新增的节点设置初始权限版本号，为所述新增的节点设置的初始权限版本号小于或等于所述初始全局版本参数。因为新增的节点的权限版本号为小于或等于全局版本参数的初始值，则新增的节点的路径信息指示的所有节点中的已设置访问权限的节点的权限版本号比所述新增的节点的权限版本号新。因此，新增的节点继承了所述新增的节点的路径信息指示的所有节点中的权限版本号最新的节点的访问权限，所以对新增的节点进行访问权限的设置，不需要存储所述新增的节点的访问权限的访问记录，提高了新增的节点的访问权限的设置效率，节省了新增的节点的访问权限的存储开销。
第二方面提供一种文件系统的权限设置装置，包括用于执行第一方面或第一方面的任一种可能实现方式中的文件系统的权限设置方法的各个模块，所述模块可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
第三方面提供一种文件系统的权限设置装置，包括处理器和接口，所述接口用于接收请求消息；所述处理器用于执行第一方面或第一方面的任意可能的实现方式中的方法。
本发明提供一种文件系统的权限设置方法及装置，所述方法由存储系统执行，具体包括所述方法应用于存储系统，包括：所述存储系统接收权限设置请求，所述权限设置 请求用于请求对文件系统的目录树上的节点进行访问权限设置，所述权限设置请求包括待设置权限的节点的标识和权限记录。所述存储系统接收权限设置请求后，所述存储系统获取当前记录的全局版本参数，对所述当前记录的全局版本参数进行更新，得到最新的全局版本参数。所述存储系统保存所述待设置权限的节点的标识和权限记录，并将所述最新的全局版本参数作为所述待设置权限的节点的权限版本号。其中，全局版本参数递增或者递减设置，每个全局版本参数表示所述目录树的任意节点的一次权限设置操作。其中，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录。本发明提供的文件系统的权限设置方法，实现快速设置目录树的节点的访问权限的权限记录，通过更新的全局版本参数表示所述目录树的任意节点的一次权限设置操作，该方法中，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录，所以仅设置目录树的父节点的权限记录，并使父节点对应的目录下的所有文件及所有子目录都继承所述父节点的权限记录，不用遍历父节点下的所有子目录或者文件来分别设置父节点下的每一个子目录或者文件的权限记录，提高了目录树的访问权限的设置效率。对父节点设置权限记录，不用对父节点对应的目录下的子目录以及文件重复设置权限记录，减少了存储空间的开销。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍。
图1为本发明实施例提供的一种存储系统的架构示意图；
图2为本发明实施例提供的一种NAS存储系统100的结构示意图；
图3为本发明实施例提供的一种目录树的组织形式示意图；
图4为本发明实施例提供的一种访问数据的方法流程图；
图5为本发明实施例提供的一种对新增的节点的访问权限进行设置的方法流程图；
图6为本发明实施例提供的一种文件系统的权限设置装置结构图。
具体实施方式
下面将结合附图，对本发明实施例中的技术方案进行描述。
请参见图1，图1为本发明实施例提供的一种存储系统的架构示意图。所述存储系统可以为网络连接式(network-attached storage，NAS)存储系统或者存储区域网络式(storage Area Network,SAN)存储系统。本发明以NAS存储系统为例进行说明。如图1所示，用户通过客户端和NAS存储系统100进行通信。客户端可以为终端设备或者各种类型的服务器。NAS存储系统通过网络和文件共享协议，将数据提供给客户端访问，使用的协议包括用于数据传输的传输控制(Transmission Control Protocol，TCP)协议，因特网互联(Internet Protocol，IP)协议以及用于网络文件服务的网络通用文件(Common Internet File，CIFS)协议和网络文件系统(Network File System，NFS)协议。
本发明实施例的终端设备包括平板电脑、笔记本电脑、移动互联网设备、掌上电脑、台式电脑、手机或者其他产品形态的终端设备。
本发明实施例的NAS存储系统100可以是文件服务器，也可以是计算机或者台式电脑等存储设备。
基于文件系统实现的目录树，目录树包括根目录、子目录以及子目录下的文件，根 目录或者子目录中不但可以包含文件，而且还可以包含下一级子目录，以此类推构成了多级目录结构的目录树。
按照节点的功能划分，目录树中的节点包括挂载节点、目录节点和文件节点。按照节点的结构划分，目录树包括根节点、中间节点和叶子节点。挂载节点为目录树的根节点，目录节点为目录树的中间节点，文件节点为目录树的叶子节点。除了根节点之外，每一个节点作为子节点时，每一个子节点都具有其自身的父节点。除了叶子节点之外，每一个节点作为父节点时，每一个父节点都具有其自身的子节点。在目录树中，父节点对应的目录下的各级子目录和文件分别所属的节点都是所述父节点的子节点。
在目录树中的每一个节点的路径信息用于指示从所述目录树的根节点到所述节点的访问分支上的所有节点。从所述根节点到所述节点的访问分支为所述根节点至所述节点的路径，依据根节点至所述节点的路径可以标识所述节点在目录树中的位置，以及该路径中的所有节点在目录树中的位置。路径中的每一个节点对应的目录下的所有子目录及文件分别属于不同的目录级别。所述目录树中的每个节点的路径中，父节点对应的目录的目录级别高于所属于该父节点的所有子节点分别对应的目录的目录级别，所述待访问节点的路径中的所述待访问节点对应的目录的目录级别最低，根节点对应的目录的目录级别最高。
请参见图2，图2为本发明实施例提供的一种NAS存储系统100的结构示意图。NAS存储系统100用于存储，包括控制器210和存储阵列220。
控制器210，用于接收客户端对数据的访问请求，根据接收到的访问请求进行鉴权，当鉴权通过后，确定待访问数据在存储阵列220中的位置信息，向存储阵列220中的数据发起访问。
控制器210还用于对目录树中的节点的访问权限进行设置。进行访问权限设置时，保存权限记录，权限记录描述了客户端对节点的访问权限，所述权限记录包括访问控制项(Access Control Entry，ACE)，所述访问控制项记录了节点的访问权限类型、节点的可访问对象，以及节点的可访问对象对所述节点的访问权限等内容。
存储阵列220，用于存储数据。控制器210对待访问请求进行鉴权，当鉴权通过后，控制器210访问所述待访问节点的数据。
存储阵列220，还用于存储数据的元数据。所述元数据是用于对存储的数据进行描述的数据，包括标准属性数据、扩展属性数据和布局属性数据。标准属性数据用于描述数据的大小和修改时间等标准属性，布局属性数据用于描述数据的存储位置，扩展属性数据包括描述节点的访问权限的数据。
现有方案中，设置ACL权限采用遍历目录树所包含的所有节点来进行权限设置，这种权限设置机制耗时长，影响业务处理效率，并且，目录树所包含的根目录、子目录和文件记录相同ACL，浪费存储空间。本发明的实施例针对现有技术中的不足，对于目录树所包含文件和子目录具有相同ACL权限的情况，提出了如下的解决方案：
本发明提出了一种快速设置目录树的ACL权限的方法。该方法仅设置目录树的父节点的ACL权限，并使父节点对应的目录下的所有文件及所有子目录都继承所述父节点的ACL权限。由于所述父节点对应的目录下的所有文件及所有子目录都继承所述父节点的ACL权限，所以仅需设置父节点的ACL权限即可，不用遍历父节点下的所有子目录或者文件来分别设置父节点下的每一个子目录或者文件的ACL权限，提高了目录树ACL权 限的设置效率。对父节点设置ACL权限，不用对父节点对应的目录下的子目录以及文件重复设置ACL权限，减少了存储空间的开销。
本发明提供的快速设置目录树的ACL权限的方法，由于父节点对应的目录下的所有文件及所有子目录都继承所述父节点的ACL权限，所以对父节点对应的目录下的任一文件或者子目录进行访问时，仅需要查询待访问的文件或者子目录至根节点的路径中的所有节点，查找具有最新的ACL权限的父节点，由于所述待访问的文件或者子目录的ACL权限继承了具有最新的ACL权限的父节点的ACL权限，所以所述具有最新的ACL权限的父节点的最新的ACL权限可以作为待访问的文件或者子目录的ACL。
本发明提供的快速设置目录树的ACL权限的方法，设置全局访问控制列表(Access Control Lists，ACL)，该全局ACL可以保存在目录树的根节点的元数据中，该全局ACL用于保存目录树上的每个节点的权限信息，也就是说，目录树上的任意节点的权限记录不再单独保存在该任意节点自身的元数据中，而由该全局ACL统一保存。并且，该全局ACL保存有全局版本参数，全局ACL通过更新后的所述全局版本参数的值指示待设置权限的节点的权限版本号。本发明提供的快速设置目录树的ACL权限的方法，在NAS存储系统100接收权限设置请求后，通过控制器210查询全局ACL，获取全局版本参数，对所述全局版本参数进行更新，得到当前全局版本参数，保存所述待设置权限的节点的标识和权限记录，并将所述当前全局版本参数作为所述待设置权限的节点的权限版本号。所述权限设置请求用于请求对文件系统的目录树上的节点进行访问权限设置，所述权限设置请求包括待设置权限的节点的标识和权限记录。
如图2所示，控制器210包含接口211和接口212，接口211用于和客户端通信。接口212用于和存储阵列220通信。控制器210还包括控制模块230，控制模块230用于对目录树中的节点的访问权限进行设置，用于对待访问节点的权限记录进行鉴权。控制模块230对待访问节点的权限记录进行鉴权，当鉴权通过后，控制模块230访问所述待访问节点的数据。
如图2所示，控制模块230包括处理器213和存储器214。处理器213用于对目录树中的节点的访问权限进行设置，用于对待访问节点的权限记录进行鉴权。处理器213对待访问节点的权限记录进行鉴权，当鉴权通过后，处理器213访问所述待访问节点的数据。
存储器214包含高速RAM存储器，也可能还包括非易失性存储器(non-volatile memory，NVM)，例如至少一个磁盘存储器。可以理解的是，存储器214可以为随机存储器(Random-Access Memory，RAM)、磁碟、硬盘、固态硬盘(solid state disk，SSD)或者非易失性存储器等各种可以存储程序代码的机器可读介质。
存储器214，用于临时存储从客户端发送的信息。
处理器213可以是任何计算器件，可以是通用中央处理器(CPU)，微处理器，可编程控制器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制以上方案程序执行的集成电路。
下面通过图2所示的NAS存储系统100的结构，详细描述NAS存储系统100中的各个部分在本发明中的作用。
在本发明中，接口211，用于接收客户端发送的权限设置请求。所述权限设置请求用于请求对文件系统的目录树上的待设置访问权限的节点进行访问权限设置。
所述权限设置请求包括目录树中待设置访问权限的节点的标识和权限记录。所述权限设置请求用于指示所述处理器213对所述当前记录的全局版本参数进行更新，得到最新的全局版本参数。
本发明中，处理器213，用于根据所述权限设置请求对待设置权限的节点进行访问权限的设置。所述处理器213，用于获取当前记录的全局版本参数，对所述当前记录的全局版本参数进行更新，得到最新的全局版本参数，其中，全局版本参数递增或者递减设置，每个全局版本参数表示所述目录树的任意节点的一次权限设置操作。所述处理器213，还用于保存所述待设置权限的节点的标识和权限记录，并将所述最新的全局版本参数作为所述待设置权限的节点的权限版本号，其中，所述待设置权限的节点的所有子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录。
所述待设置权限的节点作为父节点时，对待设置权限的节点进行访问权限设置后，所述待设置权限的节点对应的目录下的所有文件及所有子目录都继承所述待设置权限的节点的访问权限。由于所述父节点对应的目录下的所有文件及所有子目录都继承所述父节点的ACL权限，所以仅需设置所述待设置权限的节点的ACL权限即可，不用遍历父节点下的所有子目录或者文件来分别设置父节点下的每一个子目录或者文件的ACL权限，避免对与所述待设置权限的节点具有相同访问权限的其他所有子节点，进行访问权限的重复设置，提高了目录树ACL权限的设置效率。在本实施方式中，如果用数值表示全局版本参数的值，则数值越大表示访问权限越新。
另外，本发明中，不需要对与父节点具有相同访问权限的在父节点下的所有子节点进行访问权限的重复设置，进而节省了访问权限数据的存储开销。
本发明中，所述权限设置请求还可以包括所述待设置权限的节点的路径信息，所述待设置权限的节点的路径信息指示从所述根节点到所述待设置权限的节点的访问分支上的所有节点。本发明中通过设置全局ACL保存已设置访问权限的节点的标识、路径信息和权限记录的对应关系。所述全局ACL还包括全局版本参数。全局ACL保存在所述目录树的根节点的元数据中。对所述节点进行访问权限设置后，将所述最新的全局版本参数作为所述待设置权限的节点的权限版本号，所以全局ACL也可以保存已设置访问权限的节点的权限版本号。
本发明中，接口211，还用于接收客户端发送的创建全局ACL的请求。所述创建全局ACL的请求用于指示处理器213创建全局ACL，并为所述新创建的全局ACL设置初始全局版本参数。
处理器213，用于根据所述创建全局ACL的请求，创建全局ACL。创建的全局ACL保存有全局版本参数，创建的全局ACL中的全局版本参数的值为初始值，全局版本参数的初始值为0，也可以是其他数值或者字母或者其他符号标识。
请参见图3，图3为本发明实施例提供的一种目录树的组织形式示意图。如图3所示，目录树包括根节点310，中间节点311，中间节点312，叶子节点f1，叶子节点f2和叶子节点f3。
创建全局ACL后，以及在对待设置权限的节点的访问权限进行设置前，创建的全局ACL可用表1表示，表1所示的全局ACL包括全局版本参数，为所述新创建的全局ACL设置的初始全局版本参数的值为表1中所示的0，表1所示的全局ACL还用于存储文件系统的目录树的每一个节点的标识和每一个节点的路径信息。
如果通过节点的路径中的每个节点的标识确定所述节点的路径，则节点的路径信息包括子文件系统中的每个节点的标识，例如通过数字标识每一个节点，表1中所示的根节点的标识为数字310，则根节点310的路径信息包括根节点的标识中的数字310。具体的，创建的全局ACL中的所述全局版本参数，以及文件系统中的每个节点的标识，和每个节点的路径信息的对应关系如表1所示。如表1所示，全局ACL还可以用于保存待设置ACL权限的节点的权限记录和权限版本号，创建全局ACL后，如果还没有对目录树的节点进行ACL权限的设置，保存在全局ACL中的权限记录和权限版本号为空。
Figure PCTCN2018076743-appb-000001
表1
如果每个节点的路径是唯一的，可以通过节点的路径信息来标识节点，则所述全局版本参数，以及文件系统中的每个节点的标识，和每个节点的路径信息的对应关系可以如表2所示。
Figure PCTCN2018076743-appb-000002
表2
创建全局ACL之后，用户通过客户端对目录树中的节点的访问权限进行设置。
处理器213，还用于保存所述待设置权限的节点的标识和权限记录至所述全局ACL中，所述待设置权限的节点的权限版本号为更新后的所述全局版本参数的值。
处理器213，还用于在访问待访问节点的数据之前，获取所述待访问节点的访问权限。所述待访问节点的访问权限为，所述待访问节点至所述根节点的路径信息指示的所有节点中，具备最新权限版本号的节点的访问权限。具备最新权限版本号的节点通过权限记录表示访问权限，权限版本号最新的节点的权限记录。所述待访问节点的访问权限表示为所述待访问节点的路径信息指示的所有节点中具备最新权限版本号的节点对应的权限记录。
在本发明中，存储系统通过全局ACL组织目录树的所有节点的访问权限数据。在存 储阵列220中存储的所述全局ACL，用于描述待设置权限的节点的访问权限，具体地，所述全局ACL用于保存所述更新后的全局版本参数的值，以及用于保存所述待设置权限的节点的标识、路径信息和权限记录的对应关系，所述待设置权限的节点的权限版本号为更新后的所述全局版本参数的值。由于所述待设置权限的节点的标识、路径信息和权限记录形成一组对应关系，且被保存在所述全局ACL中，则只需索引目录树的根节点的元数据就可以获取到目录树的待设置权限的节点的标识、路径信息和权限记录，为获取目录树的节点的权限记录和路径信息提供了简便的访问通道。
请参见图4，图4为本发明实施例提供的一种访问数据的方法流程图。如图4所示，本实施例提供的访问权限的方法，由图2所示的NAS存储系统100执行，具体可由NAS存储系统100中的控制模块230或者图2所示的控制模块230中的处理器213执行，详细描述了在创建了目录树之后，如何对已创建好的目录树设置访问权限，然后对已创建好的目录树的待访问节点的数据进行访问的方法，具体包括如下步骤。
S401、NAS存储系统100接收客户端发送的创建全局ACL的请求。
在本发明中，所述创建全局ACL的请求用于指示NAS存储系统100创建全局ACL。
用户可以通过客户端发送创建全局ACL的请求给所述NAS存储系统100。所述创建全局ACL的请求包括目录树的根节点的标识。
基于上述所述创建全局ACL的请求的实现方式，在其他实现方式中，所述创建全局ACL的请求可以包括目录树的每一个节点的路径信息及每一个节点的标识。每一个节点的路径信息指示从所述根节点到所述节点的访问分支上的所有节点，即用于表示根节点至所述节点的路径，依据所述路径，可以查找到节点在目录树中的位置，以及路径中的中间节点在目录树中的位置，路径中除根节点以外的每一个节点分别归属于一个父节点，路径中除叶子节点以外的每一个节点都有属于其自身的子节点，除叶子节点以外的每一个节点对应的目录下的各级子目录和文件分别属于不同的目录级别。
如果通过路径中的每一个节点的标识表示节点的路径信息，则所述创建全局ACL的请求可以只包括目录树的每一个节点的路径信息。
S402、NAS存储系统100创建全局ACL。具体的，NAS存储系统100创建全局版本参数，并保存全局版本参数至所述全局ACL中，所述全局版本参数的值为初始值。
作为一种可选的实施方式，基于上述步骤S401中描述的，所述创建全局ACL的请求可以包括目录树的每一个节点的路径信息及每一个节点的标识的实现方式，NAS存储系统100保存目录树的每一个节点的路径信息和节点的标识的对应关系至所述全局ACL中。如表3所示的全局ACL包括目录树的每一个节点的路径信息和节点的标识的对应关系。表3所示的全局ACL还包括全局版本参数。基于图3所示的目录树，执行本步骤所创建的全局ACL的内容，如表3所示。
Figure PCTCN2018076743-appb-000003
Figure PCTCN2018076743-appb-000004
表3
如果通过路径中的每一个节点的标识表示节点的路径信息，全局ACL包括全局版本参数和每一个节点的路径信息。
S403、NAS存储系统100接收权限设置请求。所述权限设置请求用于请求对文件系统的目录树上的节点进行访问权限设置，所述权限设置请求包括待设置权限的节点的标识和权限记录。
具体的，用户通过客户端发送权限设置请求。
权限设置请求包括待设置权限的节点的标识和权限记录。基于图3所示的目录树，以中间节点311为待设置权限的节点为例。如图3所示，权限记录包括若干项ACE，每项ACE包含控制类型(type)、权限(mask)和用户标识(user id)等内容。其中，控制类型包含允许(allowed)或拒绝(denied)等等，用户标识(user id)表示某一用户或某类用户，权限(mask)表示相应用户的访问权限，一般采用掩码方式表示。
如果基于上述步骤S401中实现的，NAS存储系统100接收的创建全局ACL的请求中包括目录树的每一个节点的路径信息及每一个节点的标识，则新创建的全局ACL中包括目录树的每一个节点的路径信息及每一个节点的标识，则NAS存储系统100接收权限设置请求后，保存所述待设置权限的节点的权限记录至所述全局ACL，其中，所述待设置权限的节点的标识、路径信息和权限记录形成一组对应关系。
如果基于上述步骤S401中实现的，NAS存储系统100接收的创建全局ACL的请求中不包括目录树的每一个节点的路径信息及每一个节点的标识，则新创建的全局ACL中不包括目录树的每一个节点的路径信息及每一个节点的标识，则本发明的本步骤S403中的权限设置请求的一种可选的实现方式为，所述权限设置请求不仅包括待设置权限的节点的标识和权限记录，还包括所述待设置权限的节点的路径信息，所述待设置权限的节点的路径信息指示从所述根节点到所述待设置权限的节点的访问分支上的所有节点。因此，NAS存储系统100接收权限设置请求后，保存所述待设置权限的节点的路径信息至所述全局ACL，其中，所述待设置权限的节点的标识、路径信息和权限记录形成一组对应关系。
如果基于上述步骤S401中实现的，NAS存储系统100接收的创建全局ACL的请求中不包括目录树的每一个节点的路径信息及每一个节点的标识，则新创建的全局ACL中不包括目录树的每一个节点的路径信息及每一个节点的标识，则保存所述待设置权限的节点的标识、路径信息和权限记录形成的对应关系的一种可选的实现方式，将所述待设置权限的节点的标识、路径信息和权限记录形成的对应关系，保存在所述待设置权限的节点的元数据中。
S404、NAS存储系统100获取全局版本参数。
具体的，NAS存储系统100可以通过查询全局ACL，获取当前记录的全局版本参数。
所述全局访问控制列表保存在所述目录树的根节点的元数据中，所述全局访问控制列表保存有全局版本参数。基于表3所示的目录树的全局ACL中的内容，根据步骤S402中的NAS存储系统100创建的全局ACL的内容，确定已创建的全局版本参数的值为0。
S405、NAS存储系统100对当前记录的所述全局版本参数的值进行更新，得到最新的全局版本参数。所述最新的全局版本参数作为所述待设置权限的节点的权限版本号。
本发明中所述待设置权限的节点的权限版本号可以保存在所述全局ACL中，在其他实现方式中，所述待设置权限的节点的权限版本号也可以保存于所述待设置权限的节点的元数据中。
全局版本参数递增或者递减设置，每个全局版本参数表示所述目录树的任意节点的一次权限设置操作。NAS存储系统100对所述全局版本参数的值进行更新，具体的可以按照预设粒度对全局版本参数的值进行加运算或者减运算，预设粒度可以是1，可以是其他大于零的数值。具体的，在本实施方式中，NAS存储系统100将所述全局版本参数的值进行加2运算后，获得的全局版本参数的值为2。
S406、NAS存储系统100保存待设置权限的节点的标识和所述权限记录。其中，待设置权限的节点的权限版本号为更新后的所述最新的全局版本参数的值。所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录。
所述待设置权限的节点的标识和权限记录保存在所述全局ACL中，在其他实现方式中，所述待设置权限的节点的标识和权限记录也可以保存在所述待设置权限的节点的元数据中。
待设置权限的节点的权限版本号保存在所述全局ACL中，在其他实现方式中，所述待设置权限的节点的权限版本号也可以保存在所述待设置权限的节点的元数据中。
在本实施方式中，设置后的全局ACL包括更新后的全局版本参数的值、待设置权限的节点的标识、待设置权限的节点的权限版本号和所述权限记录。例如，对所述全局ACL进行设置后，所述全局ACL的内容如表4所示。设置后的所述全局ACL包括更新后的全局版本参数的值(2)、待设置权限的节点的权限版本号(2)和所述权限记录(ACE1、ACE2……ACEn)。
Figure PCTCN2018076743-appb-000005
表4
本发明提出的快速设置目录树的ACL权限的方法。该方法仅设置目录树的父节点的ACL权限，例如表4中的中间节点311的ACL权限，则父节点，例如表4中所示的中间节点311，对应的目录下的所有文件及所有子目录，例如，表4中所示的中间节点312对应的子目录以及叶子节点f1、叶子节点f2、叶子节点f3对应的文件，都继承所述父节点(表4中所示的中间节点311)的ACL权限。由于所述父节点对应的目录下的所有文 件及所有子目录都继承所述父节点的ACL权限，所以仅需设置父节点的ACL权限即可，不用遍历父节点下的所有子目录或者文件来分别设置父节点下的每一个子目录或者文件的ACL权限，提高了目录树ACL权限的设置效率。对父节点设置ACL权限，不用对父节点对应的目录下的子目录以及文件重复设置ACL权限，减少了存储空间的开销。
S407、NAS存储系统100接收访问数据的请求。
用户通过客户端发送所述访问数据的请求。所述访问数据的请求用于指示访问目录树中的待访问节点的数据，所述访问数据的请求包括目录树中的待访问节点的标识，请求访问的数据属于待访问节点，待访问节点为已建好的目录树的任意节点。目录树中全部或者部分节点设置有权限记录。本发明中，未设置权限记录的节点的权限版本号默认为最小版本号。
S408、NAS存储系统100依据所述待访问节点的标识，确认所述待访问节点的路径信息。
具体的，NAS存储系统100查询所述全局ACL或者所述待访问节点的元数据，依据所述待访问节点的标识，确认所述待访问节点的路径信息。所述待访问节点的路径信息用于指示所述待访问节点和所述待访问节点的所有父节点。
当用户访问数据之前，需要查询所述全局ACL，以获取数据所属的待访问节点的访问权限。
S409、NAS存储系统100查询所述路径信息指示的所有节点中的每一个节点的权限版本号，确认权限版本号最新的节点，获取所述权限版本号最新的节点的权限记录，作为所述待访问节点的访问权限。
NAS存储系统100获取的所述权限版本号最新的节点的权限记录为所述待访问节点的访问权限。在所述待访问节点的权限版本号是所述待访问节点及所述待访问节点的所有父节点所具备的权限版本号中最新的时，所述待访问节点的访问权限为记录的所述待访问节点的权限记录，在所述待访问节点的权限版本号不是所述待访问节点及所述待访问节点的所有父节点所具备的权限版本号中最新的时，所述待访问节点的访问权限继承自所述待访问节点的具备最新权限版本号的父节点所对应的权限记录。
具体的，在本发明中，如果以数字表示权限版本号，则NAS存储系统100查询所述路径中的每一个节点的权限版本号，确认的权限版本号最大的节点就是权限版本号最新的节点。
用户访问数据之前，需要获取数据所属的节点的访问权限，进而获取数据的访问权限。
本发明中，目录树中的全部或者部分节点的访问权限被设置，通过权限记录描述节点的访问权限。
本步骤中，所述查询所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点，具体的包括，NAS存储系统100按照预设的遍历规则，比较所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点。
本发明中，所述目录树中的每个节点的路径信息指示的所有节点分别属于不同的目录级别，所述目录树中的每个节点的路径信息指示的所有节点中的父节点的目录级别高于所属于所述父节点的子节点的目录级别，所述待访问节点的路径信息指示的所有节点 中的所述待访问节点的目录级别最低，根节点的目录级别最高。
NAS存储系统100按照预设的遍历规则，比较所述待访问节点的路径信息指示的所有节点中的每一个节点的权限版本号，确认权限版本号最新的节点的一种情况是，从所述根节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点；依据所述目录级别从高至低的顺序，直至遍历比较至所述待访问节点的路径信息指示的所有节点中的所述待访问节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点。
从所述根节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点，具体为，从所述跟节点开始，按照所述目录级别从高至低的顺序，在所述待访问节点的路径信息指示的所有节点中选取一个当前节点，每次从所述待访问节点的路径信息指示的所有节点中选取一个比所述当前节点的目录级别低一级的待比较节点，将所述当前节点和所述待比较节点进行权限版本号的比较，确认权限版本号最新的节点。依据所述目录级别从高至低的顺序，直至遍历比较至所述待访问节点的路径信息指示的所有节点中的所述待访问节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点，具体为，当所述当前节点的权限版本号为权限版本号最新的节点时，将所述当前节点继续作为当前节点，从所述待访问节点的路径信息指示的所有节点中选取一个比所述待比较节点的目录级别低一级的节点作为新的待比较节点，将所述当前节点和所述新的待比较节点进行权限版本号的比较。当所述待比较节点的权限版本号为权限版本号最新的节点时，则选择所述待比较节点作为新的当前节点，从所述待访问节点的路径信息指示的所有节点中选取一个比所述新的当前节点的目录级别低一级的节点作为新的待比较节点，进行权限版本号的比较，直至将所述目录树的所述待访问节点的权限版本号比较完成之后，确认出的当前节点为权限版本号最新的节点。
如果所述当前节点的权限版本号和所述待比较的节点的权限版本号相同时，将所述当前节点作为所述当前节点和所述待比较中的权限版本号最新的节点，则继续将所述当前节点作为当前节点，从所述待访问节点的路径信息指示的所有节点中选取一个比所述待比较节点的目录级别低一级的节点作为新的待比较节点，将所述当前节点和所述新的待比较节点进行权限版本号的比较，直至将所述目录树的所述待访问节点的权限版本号比较完成之后，确认出的当前节点为权限版本号最新的节点。
NAS存储系统100按照预设的遍历规则，比较所述待访问节点的路径信息指示的所有节点中的每一个节点的权限版本号，确认权限版本号最新的节点的另一种情况是，从所述待访问节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点；依据所述目录级别从低至高的顺序，直至遍历比较至所述待访问节点的路径信息指示的所有节点中的根节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点。
从所述待访问节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点，具体为，从所述待访问节点开始，按照所述目录级别从低至高的顺序，在所述待访问节点的路径信息指示的所有节点中选取一个当前节点，每次从所述待访问节点的路径信息指示的所有节点中选取一个比所述当前节点的目录级别高一级的待比较节点，将所述当前节点和所述待比较节点 进行权限版本号的比较，确认权限版本号最新的节点。依据所述目录级别从低至高的顺序，直至遍历比较至所述待访问节点的路径信息指示的所有节点中的根节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点，具体为，当所述当前节点的权限版本号为权限版本号最新的节点时，将所述当前节点继续作为当前节点，从所述待访问节点的路径信息指示的所有节点中选取一个比所述待比较节点的目录级别高一级的节点作为新的待比较节点，将所述当前节点和所述新的待比较节点进行权限版本号的比较。当所述待比较节点的权限版本号为权限版本号最新的节点时，则选择所述待比较节点作为新的当前节点，从所述待访问节点的路径信息指示的所有节点中选取一个比所述新的当前节点的目录级别高一级的节点作为新的待比较节点，进行权限版本号的比较，直至将所述目录树的所述根节点的权限版本号比较完成之后，确认出的当前节点为权限版本号最新的节点。
如果所述当前节点的权限版本号和所述待比较的节点的权限版本号相同时，将所述当前节点作为所述当前节点和所述待比较中的权限版本号最新的节点，则继续将所述当前节点作为当前节点，从所述待访问节点的路径信息指示的所有节点中选取一个比所述待比较节点的目录级别高一级的节点作为新的待比较节点，将所述当前节点和所述新的待比较节点进行权限版本号的比较，直至将所述目录树的所述根节点的权限版本号比较完成之后，确认出的当前节点为权限版本号最新的节点。
S410、NAS存储系统100依据所述待访问节点的访问权限进行鉴权，当鉴权通过后，客户端访问所述待访问节点的数据。所述待访问节点的访问权限为所述待访问节点至所述根节点的路径信息指示的所有节点中，具备最新权限版本号的节点的访问权限。
在本实施方式中，由于父节点对应的目录下的所有文件及所有子目录都继承所述父节点的ACL权限，所以对父节点对应的目录下的任一文件或者子目录进行访问时，仅需要查询待访问的文件或者子目录至根节点的路径中的所有节点，查找具有最新的ACL权限的父节点。例如，对表4所示的中间节点312进行访问时，由于所述中间节点312对应的子目录的ACL权限继承了具有最新的ACL权限的父节点的ACL权限，即中间节点311作为中间节点312的父节点，因中间节点312具有最新的ACL权限，所以具有最新的ACL权限的父节点的最新的ACL权限可以作为待访问的文件或者子目录的ACL。
作为一种可选的实施方式，在上述图4所示的实施方式中，在步骤S409之后，即NAS存储系统100查询所述路径信息指示的所有节点中的每一个节点的权限版本号，确认权限版本号最新的节点和所述权限版本号最新的节点的权限记录之后，NAS存储系统100可以保存待访问节点的ACL版本号和权限记录至所述全局ACL中。待访问节点的访问权限版本号为步骤S409中确认的最新的权限版本号，待访问节点的权限记录为步骤S409中确认的权限版本号最新的节点的权限记录。
在本发明中，NAS存储系统100为包括不同根节点的多个目录树分别配置一全局ACL的标识。所述全局ACL的标识包括目录树的根节点的标识，通过不同根节点的标识区分包括不同根节点的多个目录树。因此，包括不同根节点的多个目录树对应的不同全局ACL，可以通过目录树的根节点的标识区分。
在配置全局ACL的标识的其他实现方式中，全局ACL的标识还可以是目录树的根节点的标识和全局ACL的版本信息的组合。全局ACL的版本信息用于标识包括根节点的目录树的全局ACL的多个版本。对目录树增加子节点或者减少子节点后，NAS存储系 统100对改变之前的目录树的全局ACL进行备份，因此文件系统中具有包含同一根节点的多个目录树对应的多个版本，包含同一根节点的多个目录树对应的多个版本包括目录树增加节点前的全局ACL版本，或者增加节点至目录树后进行更新的全局ACL版本，或者目录树减少节点前的全局ACL版本，或者减少目录树的节点后进行更新的全局ACL版本或者对同一目录树在不同时间点备份的至少一个全局ACL版本。本发明中，备份多个全局ACL版本便于后续对全局ACL的恢复。
基于图4所示的实施例，在步骤S402之后，即在创建全局ACL之后，或者已创建目录树后，当用户需要对已创建ACL的目录树或未创建全局ACL的目录树进行更改，例如需要在目录树中增加新的目录节点或者文件节点时，本发明提供一种设置访问权限的方法，以及时对新增加的目录节点或者文件节点进行访问权限的设置。下面详细描述对已有的目录树增加了新的节点，如何对新增的节点的访问权限进行设置的方法，请参见图5，图5为本发明实施例提供的一种对新增的节点的访问权限进行设置的方法流程图，如图5所示，本实施例提供的对新增的节点的访问权限进行设置的方法，由图2所示的NAS存储系统100执行，具体可由NAS存储系统100中的控制模块230或者图2所示的控制模块230中的处理器213执行，具体包括如下步骤。
S510、NAS存储系统100接收创建节点的请求。
用户可以通过客户端发送创建节点的请求给所述NAS存储系统100。
创建节点的请求包括目录树的新增的节点的标识和路径信息，所述新增的节点的路径信息指示从所述根节点到所述新增的节点的访问分支上的所有节点。新增的节点可以是目录节点，也可以是文件节点。例如，基于图3所示的目录树，新增的节点的标识为313，路径为\310\311\313。依据新增的节点的路径，确定出所述新增的节点是在中间节点311下面新增加的一个子节点313。
如果新增的节点是根节点，则目录树的全局ACL的标识更新为包括新增的根节点的标识的标识。目录树新增根节点之前的根节点变更为新增的根节点的子节点。
在另一种实现方式中，如果通过路径中的每一个节点的标识表示节点的路径，则创建节点的请求可以只包括新增的节点的路径。因为，新增的节点的路径包括该路径中的每一个节点的标识。依据所述新增的节点的路径，可以确定出所述新增的节点的标识。
NAS存储系统100接收客户端发送的创建节点的请求后，NAS存储系统100可以对当前的全局ACL进行备份，便于用户根据不同的全局ACL版本，对目录树的访问权限进行恢复。
S520、NAS存储系统100保存所述新增的节点的标识和路径信息的对应关系。
具体的，NAS存储系统100保存所述新增的节点的标识和路径信息的对应关系至所述全局ACL中。
可选的，NAS存储系统100保存所述新增的节点的标识和路径信息的对应关系至所述新增的节点的元数据中。
在另一种实现方式中，如果通过每一个节点的标识表示节点的路径信息，则NAS存储系统100保存所述新增的节点的路径信息至所述全局ACL中或者所述新增的节点的元数据中。所以，在通过每一个节点的标识表示节点的路径信息的实施方式中，可以通过路径标识节点，节省了全局ACL的存储空间。
S530、NAS存储系统100保存所述新增的节点的权限版本号至所述全局ACL中。 新增的节点的权限版本号的值为预设的权限版本号的初始值。
具体的，NAS存储系统100保存所述新增的节点的权限版本号至所述全局ACL中。
可选的，NAS存储系统100保存所述新增的节点的权限版本号至所述新增的节点的元数据中。
在本发明中，预设的权限版本号的初始值设置为0。新增的节点的预设的权限版本号的初始值小于或等于全局版本参数的初始值。因为新增的节点的权限版本号为小于或等于全局版本参数的初始值，则新增的节点的路径信息指示的所有节点中的已设置访问权限的节点的权限版本号比所述新增的节点的权限版本号新。因此，新增的节点继承了所述新增的节点的路径信息指示的所有节点中的权限版本号最新的节点的访问权限，所以对新增的节点进行访问权限的设置，不需要存储所述新增的节点的访问权限的访问记录，提高了新增的节点的访问权限的设置效率，节省了新增的节点的访问权限的存储开销。
增加新的节点后，通过步骤S520和S530对新增节点的目录树更新全局ACL的内容，更新后的全局ACL的内容如表5所示。
Figure PCTCN2018076743-appb-000006
表5
基于图4所示的实施例，在步骤S406之后，如果对目录树新增节点，则通过上述图5所示的步骤对新增的节点进行访问权限的设置后，全局ACL的内容如表6所示。
Figure PCTCN2018076743-appb-000007
表6
基于图5所示的实施例，创建节点的请求还包括新增的节点所包括的数据，在步骤S510之后，NAS存储系统100保存所述数据至存储阵列220。
请参见图6，图6为本发明实施例提供的一种文件系统的权限设置装置结构图，本发明实施例提供的文件系统的权限设置装置应用于存储系统中，例如可以应用于所述NAS存储系统100中。如图6所示，本实施例提供的文件系统的权限设置装置60包括：接收模块61、获取模块62和处理模块63。接收模块61和获取模块62连接，处理模块63分别与获取模块62和接收模块61连接。
本发明中，接收模块61，用于接收权限设置请求，所述权限设置请求用于请求对文件系统的目录树上的节点进行访问权限设置，所述权限设置请求包括待设置权限的节点的标识和权限记录。
在本实施方式中，接收模块61接收客户端发送的权限设置请求的功能，可以通过NAS存储系统100中的接口211实现，权限设置请求的具体实现细节可以参考图4所示的步骤S403的具体细节，在这里不再赘述。
本发明中，获取模块62，用于获取当前记录的全局版本参数。
在本实施方式中，获取模块62获取当前记录的全局版本参数的功能可以通过NAS存储系统100中的接口212实现，也可以通过NAS存储系统100中的处理器213或者控制模块230实现，获取模块62获取当前记录的全局版本参数的具体实现细节，可以参考图4所示的步骤S404的具体细节，在这里不再赘述。
本发明中，处理模块63，用于对所述当前记录的全局版本参数进行更新，得到最新的全局版本参数，保存所述待设置权限的节点的标识和权限记录。其中，将所述最新的全局版本参数作为所述待设置权限的节点的权限版本号。全局版本参数递增或者递减设置，每个全局版本参数表示所述目录树的任意节点的一次权限设置操作，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录。
在本实施方式中，处理模块63对所述当前记录的全局版本参数进行更新，得到最新的全局版本参数的功能可以通过NAS存储系统100中的处理器213或者控制模块230实现，处理模块63对所述当前记录的全局版本参数进行更新，得到最新的全局版本参数的具体实现细节，可以参考图4所示的步骤S405的具体细节，在这里不再赘述。
在本实施方式中，处理模块63保存所述待设置权限的节点的标识和权限记录的功能可以通过NAS存储系统100中的处理器213或者控制模块230实现，处理模块63保存所述待设置权限的节点的标识和权限记录，以及将所述最新的全局版本参数作为所述待设置权限的节点的权限版本号的具体实现细节，可以参考图4所示的步骤S406的具体细节，在这里不再赘述。
本发明提供的文件系统的权限设置装置，实现快速设置目录树的节点的访问权限的权限记录，通过更新的全局版本参数表示所述目录树的任意节点的一次权限设置操作，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录，所以仅设置目录树的父节点的权限记录，并使父节点对应的目录下的所有文件及所有子目录都继承所述父节点的权限记录，不用遍历父节点下的所有子目录或者文件来分别设置父节点下的每一个子目录或者文件的权限记录，提高了目录树的访问权限的设置效率。对父节点设置权限记录，不用对父节点对应的目录下的子目录以及文件重复设置权限记录，减少了存储空间的开销。
作为一种可选的实施方式，所述获取模块62，还用于查询全局访问控制列表，获取 当前记录的全局版本参数，所述全局访问控制列表保存在所述目录树的根节点的元数据中，所述全局访问控制列表保存有所述全局版本参数。在本实施方式中，获取模块62查询全局访问控制列表，获取当前记录的全局版本参数的功能，可以通过NAS存储系统100中的接口212实现，也可以通过NAS存储系统100中的处理器213或者控制模块230实现，获取模块62查询全局访问控制列表，获取当前记录的全局版本参数的具体实现细节，可以参考图4所示的步骤S404的具体细节，在这里不再赘述。
作为一种可选的实施方式，所述处理模块63，还用于创建全局访问控制列表，并为所述新创建的全局访问控制列表设置初始全局版本参数。在本实施方式中，处理模块63创建全局访问控制列表，并为所述新创建的全局访问控制列表设置初始全局版本参数的功能，可以通过NAS存储系统100中的处理器213或者控制模块230实现，处理模块63创建全局访问控制列表，并为所述新创建的全局访问控制列表设置初始全局版本参数的具体实现细节，可以参考图4所示的步骤S401和S402的具体细节，在这里不再赘述。
作为一种可选的实施方式，所述权限设置请求还包括所述待设置权限的节点的路径信息，所述待设置权限的节点的路径信息指示从所述根节点到所述待设置权限的节点的访问分支上的所有节点。所述处理模块63，还用于保存所述待设置权限的节点的路径信息至所述全局访问控制列表。其中，所述待设置权限的节点的标识、路径信息和权限记录形成一组对应关系。
在本实施方式中，处理模块63保存所述待设置权限的节点的路径信息至所述全局访问控制列表的功能，可以通过NAS存储系统100中的处理器213或者控制模块230实现，处理模块63保存所述待设置权限的节点的路径信息至所述全局访问控制列表的具体实现细节，可以参考图4所示的步骤S403中的关于保存目录树的节点的路径信息的具体细节，在这里不再赘述。
由于所述待设置权限的节点的标识、路径信息和权限记录形成一组对应关系，且被保存在所述全局访问控制列表中，则只需索引目录树的根节点的元数据就可以获取到目录树的待设置权限的节点的标识、路径信息和权限记录，为获取目录树的节点的权限记录和路径信息提供了简便的访问通道。
作为一种可选的实施方式，所述接收模块61，还用于接收访问数据的请求，所述访问数据的请求包括待访问节点的标识。
在本实施方式中，接收模块61接收客户端发送的访问数据的请求的功能，可以通过NAS存储系统100中的接口211实现，访问数据的请求的具体实现细节可以参考图4所示的步骤S407的具体细节，在这里不再赘述。
所述获取模块62，还用于根据所述待访问节点的标识，获取所述待访问节点的访问权限。其中，在所述待访问节点的权限版本号是所述待访问节点及所述待访问节点的所有父节点所具备的权限版本号中最新的时，所述待访问节点的访问权限为记录的所述待访问节点的权限记录，在所述待访问节点的权限版本号不是所述待访问节点及所述待访问节点的所有父节点所具备的权限版本号中最新的时，所述待访问节点的访问权限继承自所述待访问节点的具备最新权限版本号的父节点所对应的权限记录。
在本实施方式中，获取模块62根据所述待访问节点的标识，获取所述待访问节点的访问权限的功能可以通过NAS存储系统100中的接口212实现，也可以通过NAS存储系统100中的处理器213或者控制模块230实现，获取模块62根据所述待访问节点的标 识，获取所述待访问节点的访问权限的具体实现细节，可以参考图4所示的步骤S408、S409的具体细节，在这里不再赘述。
所述处理模块63，还用于依据所述待访问节点的访问权限进行鉴权，当鉴权通过后，访问所述待访问节点的数据。
在本实施方式中，处理模块63依据所述待访问节点的访问权限进行鉴权，当鉴权通过后，访问所述待访问节点的数据的功能可以通过NAS存储系统100中的处理器213或者控制模块230实现，处理模块63依据所述待访问节点的访问权限进行鉴权，当鉴权通过后，访问所述待访问节点的数据的具体实现细节，可以参考图4所示的步骤S410的具体细节，在这里不再赘述。
作为一种可选的实施方式，所述获取模块62，还用于查询所述全局访问控制列表，根据所述待访问节点的标识，确认所述待访问节点的路径信息，查询所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点，获取所述权限版本号最新的节点的权限记录。其中，所述待访问节点的路径信息用于指示所述待访问节点和所述待访问节点的所有父节点，所述权限版本号最新的节点的权限记录为所述待访问节点的访问权限。
在本实施方式中，获取模块62查询所述全局访问控制列表，根据所述待访问节点的标识，确认所述待访问节点的路径信息的功能可以通过NAS存储系统100中的存储阵列220实现，也可以通过NAS存储系统100中的控制器210或者处理器213或者控制模块230实现，获取模块62查询所述全局访问控制列表，根据所述待访问节点的标识，确认所述待访问节点的路径信息的具体实现细节，可以参考图4所示的步骤S408的具体细节，在这里不再赘述。
在本实施方式中，获取模块62查询所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点的功能可以通过NAS存储系统100中的存储阵列220实现，也可以通过NAS存储系统100中的控制器210或者处理器213或者控制模块230实现，获取模块62查询所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点的具体实现细节，可以参考图4所示的步骤S409的具体细节，在这里不再赘述。
在本实施方式中，获取模块62获取所述权限版本号最新的节点的权限记录的功能可以通过NAS存储系统100中的接口212实现，也可以通过NAS存储系统100中的处理器213或者控制模块230实现。获取模块62获取所述权限版本号最新的节点的权限记录的具体实现细节，可以参考图4所示的步骤S409的具体细节，在这里不再赘述。
可选的，本发明中的各个模块和部件可以继承在一起，也可以分开设置。
作为一种可选的实施方式，所述获取模块62，还用于按照预设的遍历规则，比较所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点。通过预设的遍历规则比较所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点，可以依据目录树中的节点的访问权限分布规律预先设定遍历规则，以通过合适的预设的遍历规则比较所述待访问节点的路径中的每一个节点的权限版本号，确认权限版本号最新的节点，提高遍历比较的效率。
在本实施方式中，获取模块62按照预设的遍历规则，比较所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点的功能可以通过NAS存 储系统100中的存储阵列220实现，也可以通过NAS存储系统100中的控制器210或者处理器213或者控制模块230实现，获取模块62按照预设的遍历规则，比较所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点的具体实现细节，可以参考图4所示的步骤S409的具体细节，在这里不再赘述。
作为一种可选的实施方式，所述目录树中的每个节点的路径信息指示的所有节点分别属于不同的目录级别，所述目录树中的每个节点的路径信息指示的所有节点中的父节点的目录级别高于所属于所述父节点的子节点的目录级别，所述待访问节点的目录级别最低，根节点的目录级别最高。所述获取模块62，还用于从所述根节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点，依据所述目录级别从高至低的顺序，直至遍历比较至所述待访问节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点。
在本实施方式中，获取模块62从所述根节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点，依据所述目录级别从高至低的顺序，直至遍历比较至所述待访问节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点的功能可以通过NAS存储系统100中的存储阵列220实现，也可以通过NAS存储系统100中的控制器210或者处理器213或者控制模块230实现，获取模块62从所述根节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点，依据所述目录级别从高至低的顺序，直至遍历比较至所述待访问节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点的具体实现细节，可以参考图4所示的步骤S409的具体细节，在这里不再赘述。
作为一种可选的实施方式，所述目录树中的每个节点的路径信息指示的所有节点分别属于不同的目录级别，所述目录树中的每个节点的路径信息指示的所有节点中的父节点的目录级别高于所属于所述父节点的子节点的目录级别，所述待访问节点的目录级别最低，所述根节点的目录级别最高。所述获取模块62，还用于从所述待访问节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点，依据所述目录级别从低至高的顺序，直至遍历比较至所述根节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点。
在本实施方式中，获取模块62从所述待访问节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点，依据所述目录级别从低至高的顺序，直至遍历比较至所述根节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点的功能可以通过NAS存储系统100中的存储阵列220实现，也可以通过NAS存储系统100中的控制器210或者处理器213或者控制模块230实现，获取模块62从所述待访问节点开始，每次选取并比较所述待访问节点的路径信息指示的所有节点中的两个节点的权限版本号，确认权限版本号最新的节点，依据所述目录级别从低至高的顺序，直至遍历比较至所述根节点时，确认的权限版本号最新的节点为所述权限版本号最新的节点的具体实现细节，可以参考图4所示的步骤S409的具体细节，在这里不再赘述。
作为一种可选的实施方式，所述接收模块61，还用于接收创建节点的请求。所述创建节点的请求包括所述目录树的新增的节点的标识和路径信息，所述新增的节点的路径 信息指示从所述根节点到所述新增的节点的访问分支上的所有节点。
在本实施方式中，接收模块61接收客户端发送的创建节点的请求的功能，可以通过NAS存储系统100中的接口211实现，创建节点的请求的具体实现细节可以参考图5所示的步骤S510的具体细节，在这里不再赘述。
所述处理模块63，还用于保存所述目录树的所述新增的节点的标识和路径信息的对应关系至所述全局访问控制列表中，保存所述新增的节点的权限版本号至所述全局访问控制列表中。所述新增的节点的权限版本号的初始值小于或等于创建的所述全局版本参数的初始值，为所述新增的节点设置初始权限版本号，为所述新增的节点设置的初始权限版本号小于或等于所述初始全局版本参数。
在本实施方式中，处理模块63保存所述目录树的所述新增的节点的标识和路径信息的对应关系至所述全局访问控制列表中的功能可以通过NAS存储系统100中的处理器213或者控制模块230实现，处理模块63保存所述目录树的所述新增的节点的标识和路径信息的对应关系至所述全局访问控制列表中的具体实现细节，可以参考图5所示的步骤S520的具体细节，在这里不再赘述。
在本实施方式中，处理模块63保存所述新增的节点的权限版本号至所述全局访问控制列表中的功能可以通过NAS存储系统100中的处理器213或者控制模块230实现，处理模块63保存所述新增的节点的权限版本号至所述全局访问控制列表中的具体实现细节，可以参考图5所示的步骤S530的具体细节，在这里不再赘述。
本发明提供一种文件系统的权限设置方法及装置，所述方法由存储系统执行，具体包括所述方法应用于存储系统，包括：所述存储系统接收权限设置请求，所述权限设置请求用于请求对文件系统的目录树上的节点进行访问权限设置，所述权限设置请求包括待设置权限的节点的标识和权限记录。所述存储系统接收权限设置请求后，所述存储系统获取当前记录的全局版本参数，对所述当前记录的全局版本参数进行更新，得到最新的全局版本参数。所述存储系统保存所述待设置权限的节点的标识和权限记录，并将所述最新的全局版本参数作为所述待设置权限的节点的权限版本号。其中，全局版本参数递增或者递减设置，每个全局版本参数表示所述目录树的任意节点的一次权限设置操作。其中，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录。本发明提供的文件系统的权限设置方法，实现快速设置目录树的节点的访问权限的权限记录，通过更新的全局版本参数表示所述目录树的任意节点的一次权限设置操作，该方法中，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录，所以仅设置目录树的父节点的权限记录，并使父节点对应的目录下的所有文件及所有子目录都继承所述父节点的权限记录，不用遍历父节点下的所有子目录或者文件来分别设置父节点下的每一个子目录或者文件的权限记录，提高了目录树的访问权限的设置效率。对父节点设置权限记录，不用对父节点对应的目录下的子目录以及文件重复设置权限记录，减少了存储空间的开销。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单 元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (27)

  1. 一种文件系统的权限设置方法，其特征在于，包括：
    接收权限设置请求，所述权限设置请求用于请求对文件系统的目录树上的节点进行访问权限设置，所述权限设置请求包括待设置权限的节点的标识和权限记录；
    获取当前记录的全局版本参数；
    对所述当前记录的全局版本参数进行更新，得到最新的全局版本参数，其中，全局版本参数递增或者递减设置，每个全局版本参数表示所述目录树的任意节点的一次权限设置操作；
    保存所述待设置权限的节点的标识和权限记录，并将所述最新的全局版本参数作为所述待设置权限的节点的权限版本号，其中，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录。
  2. 如权利要求1所述的方法，其特征在于，所述获取当前记录的全局版本参数，包括：
    查询全局访问控制列表，获取当前记录的全局版本参数，所述全局访问控制列表保存在所述目录树的根节点的元数据中，所述全局访问控制列表保存有所述全局版本参数。
  3. 如权利要求2所述的方法，其特征在于，所述接收权限设置请求之前，还包括：
    创建全局访问控制列表，并为所述新创建的全局访问控制列表设置初始全局版本参数。
  4. 如权利要求2或3所述的方法，其特征在于，所述权限设置请求还包括所述待设置权限的节点的路径信息，所述待设置权限的节点的路径信息指示从所述根节点到所述待设置权限的节点的访问分支上的所有节点，所述方法还包括：
    保存所述待设置权限的节点的路径信息至所述全局访问控制列表，其中，所述待设置权限的节点的标识、路径信息和权限记录形成一组对应关系。
  5. 如权利要求1-4任一所述的方法，其特征在于，还包括：
    接收访问数据的请求，所述访问数据的请求包括待访问节点的标识；
    根据所述待访问节点的标识，获取所述待访问节点的访问权限，其中，在所述待访问节点的权限版本号不是所述待访问节点的路径信息所指示的全部节点所具备的权限版本号中最新的时，所述待访问节点的访问权限继承自所述待访问节点的具备最新权限版本号的父节点所对应的权限记录；
    依据所述待访问节点的访问权限进行鉴权，当鉴权通过后，访问所述待访问节点的数据。
  6. 如权利要求5所述的方法，其特征在于，在所述待访问节点的权限版本号是所述待访问节点的路径信息所指示的全部节点所具备的权限版本号中最新的时，所述待访问节点的访问权限为记录的所述待访问节点的权限记录。
  7. 如权利要求6所述的方法，所述根据所述待访问节点的标识，获取所述待访问节 点的访问权限，包括：查询所述全局访问控制列表，根据所述待访问节点的标识，确认所述待访问节点的路径信息，所述待访问节点的路径信息用于指示所述待访问节点和所述待访问节点的所有父节点；
    查询所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点；
    获取所述权限版本号最新的节点的权限记录，所述权限版本号最新的节点的权限记录为所述待访问节点的访问权限。
  8. 如权利要求7所述的方法，其特征在于，所述查询所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点，包括：
    按照预设的遍历规则，比较所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点。
  9. 如权利要求2-8任一所述的方法，其特征在于，还包括：
    接收创建节点的请求，所述创建节点的请求包括所述目录树的新增的节点的标识和路径信息，所述新增的节点的路径信息指示从所述根节点到所述新增的节点的访问分支上的所有节点；
    保存所述目录树的所述新增的节点的标识和路径信息的对应关系至所述全局访问控制列表中；
    为所述新增的节点设置初始权限版本号，为所述新增的节点设置的初始权限版本号小于或等于所述初始全局版本参数。
  10. 一种文件系统的权限设置装置，其特征在于，包括：
    接口，用于接收权限设置请求，所述权限设置请求用于请求对文件系统的目录树上的节点进行访问权限设置，所述权限设置请求包括待设置权限的节点的标识和权限记录；
    处理器，用于获取当前记录的全局版本参数，对所述当前记录的全局版本参数进行更新，得到最新的全局版本参数，保存所述待设置权限的节点的标识和权限记录，并将所述最新的全局版本参数作为所述待设置权限的节点的权限版本号，其中，全局版本参数递增或者递减设置，每个全局版本参数表示所述目录树的任意节点的一次权限设置操作，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录。
  11. 如权利要求10所述的装置，其特征在于，所述处理器，还用于查询全局访问控制列表，获取当前记录的全局版本参数，所述全局访问控制列表保存在所述目录树的根节点的元数据中，所述全局访问控制列表保存有所述全局版本参数。
  12. 如权利要求11所述的装置，其特征在于，所述处理器，还用于创建全局访问控制列表，并为所述新创建的全局访问控制列表设置初始全局版本参数。
  13. 如权利要求11或12所述的装置，其特征在于，所述权限设置请求还包括所述 待设置权限的节点的路径信息，所述待设置权限的节点的路径信息指示从所述根节点到所述待设置权限的节点的访问分支上的所有节点，所述处理器，还用于保存所述待设置权限的节点的路径信息至所述全局访问控制列表，其中，所述待设置权限的节点的标识、路径信息和权限记录形成一组对应关系。
  14. 如权利要求10-13任一所述的装置，其特征在于，所述接口，还用于接收访问数据的请求，所述访问数据的请求包括待访问节点的标识；
    所述处理器，还用于根据所述待访问节点的标识，获取所述待访问节点的访问权限，依据所述待访问节点的访问权限进行鉴权，当鉴权通过后，访问所述待访问节点的数据，其中，在所述待访问节点的权限版本号不是所述待访问节点的路径信息所指示的全部节点所具备的权限版本号中最新的时，所述待访问节点的访问权限继承自所述待访问节点的具备最新权限版本号的父节点所对应的权限记录。
  15. 如权利要求14所述的装置，其特征在于，在所述待访问节点的权限版本号是所述待访问节点的路径信息所指示的全部节点所具备的权限版本号中最新的时，所述待访问节点的访问权限为记录的所述待访问节点的权限记录。
  16. 如权利要求15所述的装置，所述处理器，还用于查询所述全局访问控制列表，根据所述待访问节点的标识，确认所述待访问节点的路径信息，查询所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点，获取所述权限版本号最新的节点的权限记录，所述权限版本号最新的节点的权限记录为所述待访问节点的访问权限，其中，所述待访问节点的路径信息用于指示所述待访问节点和所述待访问节点的所有父节点。
  17. 如权利要求16所述的装置，其特征在于，所述处理器，还用于按照预设的遍历规则，比较所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点。
  18. 如权利要求11-17任一所述的装置，其特征在于，所述接口，还用于接收创建节点的请求，所述创建节点的请求包括所述目录树的新增的节点的标识和路径信息，所述新增的节点的路径信息指示从所述根节点到所述新增的节点的访问分支上的所有节点；
    所述处理器，还用于保存所述目录树的所述新增的节点的标识和路径信息的对应关系至所述全局访问控制列表中，保存所述新增的节点的权限版本号至所述全局访问控制列表中，所述新增的节点的权限版本号的初始值小于或等于创建的所述全局版本参数的初始值，为所述新增的节点设置初始权限版本号，为所述新增的节点设置的初始权限版本号小于或等于所述初始全局版本参数。
  19. 一种文件系统的权限设置装置，其特征在于，包括：
    接收模块，用于接收权限设置请求，所述权限设置请求用于请求对文件系统的目录 树上的节点进行访问权限设置，所述权限设置请求包括待设置权限的节点的标识和权限记录；
    获取模块，用于获取当前记录的全局版本参数；
    处理模块，用于对所述当前记录的全局版本参数进行更新，得到最新的全局版本参数，保存所述待设置权限的节点的标识和权限记录，并将所述最新的全局版本参数作为所述待设置权限的节点的权限版本号，其中，全局版本参数递增或者递减设置，每个全局版本参数表示所述目录树的任意节点的一次权限设置操作，所述待设置权限的节点的子节点的权限记录继承自所述待设置权限的节点的当前权限设置操作之后的权限记录。
  20. 如权利要求19所述的装置，其特征在于，所述获取模块，还用于查询全局访问控制列表，获取当前记录的全局版本参数，所述全局访问控制列表保存在所述目录树的根节点的元数据中，所述全局访问控制列表保存有所述全局版本参数。
  21. 如权利要求20所述的装置，其特征在于，所述处理模块，还用于创建全局访问控制列表，并为所述新创建的全局访问控制列表设置初始全局版本参数。
  22. 如权利要求20或21所述的装置，其特征在于，所述权限设置请求还包括所述待设置权限的节点的路径信息，所述待设置权限的节点的路径信息指示从所述根节点到所述待设置权限的节点的访问分支上的所有节点，所述处理模块，还用于保存所述待设置权限的节点的路径信息至所述全局访问控制列表，其中，所述待设置权限的节点的标识、路径信息和权限记录形成一组对应关系。
  23. 如权利要求19-22任一所述的装置，其特征在于，所述接收模块，还用于接收访问数据的请求，所述访问数据的请求包括待访问节点的标识；
    所述获取模块，还用于根据所述待访问节点的标识，获取所述待访问节点的访问权限，其中，在所述待访问节点的权限版本号不是所述待访问节点的路径信息所指示的全部节点所具备的权限版本号中最新的时，所述待访问节点的访问权限继承自所述待访问节点的具备最新权限版本号的父节点所对应的权限记录；
    所述处理模块，还用于依据所述待访问节点的访问权限进行鉴权，当鉴权通过后，访问所述待访问节点的数据。
  24. 如权利要求23所述的装置，其特征在于，在所述待访问节点的权限版本号是所述待访问节点的路径信息所指示的全部节点所具备的权限版本号中最新的时，所述待访问节点的访问权限为记录的所述待访问节点的权限记录。
  25. 如权利要求24所述的装置，所述获取模块，还用于查询所述全局访问控制列表，根据所述待访问节点的标识，确认所述待访问节点的路径信息，查询所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点，获取所述权限版本号最新的节点的权限记录，其中，所述待访问节点的路径信息用于指示所述待访问节点和所述待访问节点的所有父节点，所述权限版本号最新的节点的权限记录为所述待 访问节点的访问权限。
  26. 如权利要求25所述的装置，其特征在于，所述获取模块，还用于按照预设的遍历规则，比较所述待访问节点的路径信息指示的每一个节点的权限版本号，确认权限版本号最新的节点。
  27. 如权利要求20-26任一所述的装置，其特征在于，所述接收模块，还用于接收创建节点的请求，所述创建节点的请求包括所述目录树的新增的节点的标识和路径信息，所述新增的节点的路径信息指示从所述根节点到所述新增的节点的访问分支上的所有节点；
    所述处理模块，还用于保存所述目录树的所述新增的节点的标识和路径信息的对应关系至所述全局访问控制列表中，保存所述新增的节点的权限版本号至所述全局访问控制列表中，所述新增的节点的权限版本号的初始值小于或等于创建的所述全局版本参数的初始值，为所述新增的节点设置初始权限版本号，为所述新增的节点设置的初始权限版本号小于或等于所述初始全局版本参数。
PCT/CN2018/076743 2017-06-30 2018-02-13 一种文件系统的权限设置方法及装置 WO2019000979A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP18825506.1A EP3614290B1 (en) 2017-06-30 2018-02-13 File system access rights configuration method and device
JP2019561914A JP6965370B2 (ja) 2017-06-30 2018-02-13 ファイルシステムパーミッション設定方法及び装置
US16/718,995 US11238175B2 (en) 2017-06-30 2019-12-18 File system permission setting method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710526991.0A CN107451486B (zh) 2017-06-30 2017-06-30 一种文件系统的权限设置方法及装置
CN201710526991.0 2017-06-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/718,995 Continuation US11238175B2 (en) 2017-06-30 2019-12-18 File system permission setting method and apparatus

Publications (1)

Publication Number Publication Date
WO2019000979A1 true WO2019000979A1 (zh) 2019-01-03

Family

ID=60488586

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/076743 WO2019000979A1 (zh) 2017-06-30 2018-02-13 一种文件系统的权限设置方法及装置

Country Status (5)

Country Link
US (1) US11238175B2 (zh)
EP (1) EP3614290B1 (zh)
JP (1) JP6965370B2 (zh)
CN (1) CN107451486B (zh)
WO (1) WO2019000979A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113190550A (zh) * 2021-03-31 2021-07-30 郑州信大捷安信息技术股份有限公司 一种基于树形结构的组织结构权限分配方法

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107451486B (zh) * 2017-06-30 2021-05-18 华为技术有限公司 一种文件系统的权限设置方法及装置
CN108614976A (zh) * 2018-04-28 2018-10-02 苏州科达科技股份有限公司 权限配置方法、装置及存储介质
CN109145621B (zh) * 2018-08-14 2021-09-14 创新先进技术有限公司 文档管理方法及装置
CN109167775B (zh) * 2018-08-23 2021-10-22 郑州云海信息技术有限公司 基于分布式存储的acl设置方法、装置、终端及存储介质
US10862750B2 (en) * 2019-03-31 2020-12-08 Td Ameritrade Ip Company, Inc. Network configuration apparatus
CN110245149B (zh) * 2019-06-25 2021-09-17 北京明略软件系统有限公司 元数据的版本管理方法及装置
CN110781505B (zh) * 2019-10-11 2020-09-25 南京医基云医疗数据研究院有限公司 系统构建方法及装置、检索方法及装置、介质和设备
CN113094737B (zh) * 2019-12-23 2024-07-05 斑马智行网络(香港)有限公司 信息处理方法、装置及设备
CN111258958A (zh) * 2020-01-10 2020-06-09 北京猎豹移动科技有限公司 一种数据获取方法、数据提供方法及装置
CN111538864B (zh) * 2020-03-25 2023-03-31 新华三技术有限公司合肥分公司 一种减少Buildrun消耗的方法及装置
CN111881473B (zh) * 2020-07-22 2024-03-19 深圳市友杰智新科技有限公司 隐私文件保护方法、装置、计算机设备和可读存储介质
US12001574B2 (en) 2020-12-21 2024-06-04 Dropbox, Inc. Evaluating an access control list from permission statements
US11366793B1 (en) 2020-12-21 2022-06-21 Dropbox, Inc. Data model and data service for content management system
US20220198283A1 (en) * 2020-12-22 2022-06-23 Paypal, Inc. Dynamic reconstruction of decision tree structures
CN112685606A (zh) * 2020-12-31 2021-04-20 上海氪邦智能技术有限公司 权限规则的配置/管理方法、系统、计算机介质及终端
CN115086337B (zh) * 2022-06-23 2024-04-26 中国工商银行股份有限公司 文件处理方法、装置、存储介质以及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1605992A (zh) * 2003-10-10 2005-04-13 鸿富锦精密工业（深圳）有限公司 访问控制列表中用户权限快取生成系统及方法
CN105262800A (zh) * 2015-09-23 2016-01-20 浪潮(北京)电子信息产业有限公司 一种应用于集群nas文件系统的权限控制方法及系统
CN106713493A (zh) * 2017-01-20 2017-05-24 郑州云海信息技术有限公司 一种在计算机集群环境中构建分布式文件系统及方法
CN107451486A (zh) * 2017-06-30 2017-12-08 华为技术有限公司 一种文件系统的权限设置方法及装置

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1219260C (zh) * 2003-09-02 2005-09-14 四川大学 一种安全文件系统的存储及访问控制方法
TWI263894B (en) 2003-10-15 2006-10-11 Hon Hai Prec Ind Co Ltd System and method for quickly getting user's permission in access control list
CN100370441C (zh) * 2003-10-18 2008-02-20 鸿富锦精密工业（深圳）有限公司 遍历访问控制列表中许可权方法
JP4514768B2 (ja) * 2007-04-19 2010-07-28 株式会社エスグランツ カップルドノードツリーの退避／復元装置、退避／復元方法及びプログラム
JP4498409B2 (ja) * 2007-12-28 2010-07-07 株式会社エスグランツ データベースのインデックスキー更新方法及びプログラム
JP5165662B2 (ja) * 2009-10-27 2013-03-21 株式会社高速屋 ビット列キー分類・分配装置、分類・分配方法及びプログラム
WO2011064984A1 (ja) * 2009-11-30 2011-06-03 株式会社エスグランツ ビット列検索装置、検索方法及びプログラム
US8713056B1 (en) * 2011-03-30 2014-04-29 Open Text S.A. System, method and computer program product for efficient caching of hierarchical items
CN103064957B (zh) * 2012-12-28 2016-06-15 华为技术有限公司 实现acl的方法及客户端
WO2014153759A1 (zh) * 2013-03-28 2014-10-02 华为技术有限公司 一种访问控制权限管理方法和装置
CN103176866A (zh) * 2013-04-02 2013-06-26 浪潮电子信息产业股份有限公司 一种应用于ntfs文件系统下的文件权限备份方法
US10498535B2 (en) * 2015-02-16 2019-12-03 Nec Corporation Method and system for verifying information of a data item in a plurality of different data items
US10168998B2 (en) * 2017-03-20 2019-01-01 Google Llc Automated interface design

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1605992A (zh) * 2003-10-10 2005-04-13 鸿富锦精密工业（深圳）有限公司 访问控制列表中用户权限快取生成系统及方法
CN105262800A (zh) * 2015-09-23 2016-01-20 浪潮(北京)电子信息产业有限公司 一种应用于集群nas文件系统的权限控制方法及系统
CN106713493A (zh) * 2017-01-20 2017-05-24 郑州云海信息技术有限公司 一种在计算机集群环境中构建分布式文件系统及方法
CN107451486A (zh) * 2017-06-30 2017-12-08 华为技术有限公司 一种文件系统的权限设置方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113190550A (zh) * 2021-03-31 2021-07-30 郑州信大捷安信息技术股份有限公司 一种基于树形结构的组织结构权限分配方法
CN113190550B (zh) * 2021-03-31 2022-03-22 郑州信大捷安信息技术股份有限公司 一种基于树形结构的组织结构权限分配方法

Also Published As

Publication number Publication date
US20200125758A1 (en) 2020-04-23
EP3614290A4 (en) 2020-04-29
JP2020524321A (ja) 2020-08-13
CN107451486A (zh) 2017-12-08
JP6965370B2 (ja) 2021-11-10
EP3614290B1 (en) 2023-10-04
US11238175B2 (en) 2022-02-01
EP3614290A1 (en) 2020-02-26
CN107451486B (zh) 2021-05-18

Similar Documents

Publication Publication Date Title
WO2019000979A1 (zh) 一种文件系统的权限设置方法及装置
WO2019000978A1 (zh) 一种文件系统的权限设置方法及装置
US9774586B1 (en) Dynamic authorization of users in a multi-tenant environment using tenant authorization profiles
JP4770921B2 (ja) ゲートウェイサーバ、ファイル管理システム、ファイル管理方法とプログラム
CN109936571B (zh) 一种海量数据共享方法、开放共享平台及电子设备
US10037341B1 (en) Nesting tree quotas within a filesystem
JP4671332B2 (ja) ユーザ識別情報を変換するファイルサーバ
JP5439337B2 (ja) 情報処理システム、情報処理システムの制御方法、検索制御装置
US10296595B2 (en) Multi-level namespace management system and method thereof for hybrid cloud storage systems
US10057273B1 (en) System and method for ensuring per tenant mutual exclusion of data and administrative entities with low latency and high scale
EP3278538A1 (en) Secure cloud-based storage of data shared across file system objects and clients
US9607170B2 (en) Compromise free cloud data encryption and security
US11768883B2 (en) System and method for in-place record content management
US10404702B1 (en) System and method for tenant network identity-based authentication and authorization for administrative access in a protection storage system
WO2015103794A1 (zh) 一种文件访问权限控制方法及装置
WO2019128984A1 (zh) 容器的安全策略的处理方法和相关装置
US20140189355A1 (en) Encrypting globally unique identifiers at communication boundaries
US11550942B2 (en) Universal file access control system and method
WO2022116847A1 (zh) 一种数据存储方法、装置、计算机设备及存储介质
JP2024513300A (ja) リンクプラットフォーム及びパートナーサービスによるリンクの共同管理
US10097359B2 (en) Automatic elevation of system security
US9122690B1 (en) Systems and methods for implementing non-native file attributes on file systems
WO2014147811A1 (ja) ファイルストレージシステムおよびユーザデータ管理方法
US10887429B1 (en) Processing multi-protocol redirection links
CN109710582B (zh) 一种共享目录管理方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18825506

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019561914

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2018825506

Country of ref document: EP

Effective date: 20191120

NENP Non-entry into the national phase

Ref country code: DE