Patent Application
20090248701
The present invention generally relates to a file system operating on a computer system. The present invention specifically relates to a system configured to enable redirected file access within a computer system though an HTTP web server.
Symbolic links (commonly referred to as a symlink or “soft link”) are a special type of file that serves as a reference to another file or directory. Unix-based operating systems, in particular, feature symbolic links. Unlike a hard link, which points directly to data and represents another name for the same file, a symbolic link contains a path that identifies the target of the symbolic link. Thus, when a user removes a symbolic link, the file to which it pointed remains unaffected. A large advantage of symbolic links is that they operate transparently, meaning that programs that read or write to files named by a symbolic link behave as if operating directly on the target file.
In the current art, there are many cases where copying large files between computer systems is simply unfeasible. For example, a core dump from an operating system may result in data consuming gigabytes of space. Symbolic links are useful for accessing these large files, particularly because symbolic links may refer to files on other mounted file systems, allowing access to a large file on another file system without first requiring the transfer of the file. However, existing symbolic links do not allow access to files existing on a remote network.
For many organizations, the only way into their computer network from a remote location is through HTTP and their web servers. Such organizations would not entertain the idea of giving a user from another organization a trusted VPN connection into their internal network for the purpose of accessing a particular file. Furthermore, it is not feasible for the web server to use any kind of file network protocol (such as SAMBA), since there are too many security vulnerabilities and intractable problems such as remote authentication between untrusted domains.
What is needed is a way to allow remote access to files through a web server while utilizing the advantages of a symbolic link.
The present invention provides a new and unique system configured for redirecting file access though a web server. This file access is accomplished by the use of a symbolic link, with the symbolic link being modified to enable an internet connection to the desired file via a web server.
In one embodiment of the invention, a symbolic link is created to access a file hosted on a remote workstation file system or file store. This file stored on the remote workstation may not be easily accessed at an external system due to its size or an inability to be accessed via an external network connection. The file on this file system or file store, however, is accessible by a web server, and the web server is accessible over the internet by computers in external networks.
The symbolic link is modified to include connection information to access the file through the web server such as the web server IP address or DNS name. This connection information may also be accompanied by authentication information, such as a username and password or other security authenticators. The modified symbolic link then is utilized within an external file system (the “local computing system”) which is remote to the workstation file system or store, with the local computing system having internet access to the web server.
When the symbolic link is accessed on the local computing system, the connection and authentication information contained within the symbolic link is processed by the local computing system to create a connection to the web server. Once the connection has been opened and authenticated, the file system driver on the local computing system redirects all I/O requests for the file through HTTP to the web server. For secure access to the file, the file system driver may optionally send requests using HTTPS.
In a further embodiment of the present invention, the local computing system contains a driver to distinguish between modified symbolic links and symbolic links in use for local files on the file system. This driver allows both symbolic links and modified symbolic links to be used on a file system, allowing applications to utilize unmodified symbolic links on the file system without interruption. In a further embodiment, the modified link may contain parameters used within the request to the web server to indicate a section of the file required by an application.
One aspect of the present invention introduces a new kind of symbolic link that can reroute file access requests through a web server. This allows the data to remain on the file system where it was generated, while facilitating the benefits of a symbolic link to allow a remote user to access the data as if it exists on the local file system. Further, through the use of a specialized file system driver according to a further aspect of the present invention, applications and existing symbolic links within the operating system continue to work as before without modification.
In one embodiment of the present invention, a symbolic link is modified to contain connection information to the web server which has access to the desired data. This connection information would typically include a URL, authentication information such as user name and password. This connection information placed within the symbolic link file gives the file system enough information to establish a remote connection, while allowing the symbolic link appear as a regular symbolic link file in the file system.
The present invention utilizes symbolic links, which are well known in UNIX operating systems as a file reference to other files, similar to the use of “shortcuts” in Windows. In the present invention, the symbolic link refers to a file that is stored at a URI location (such as can be defined by a URL). In operation, HTTP or an equivalent communication protocol is used to access the file data using the symbolic link.
The remote workstation 120 has no special software running on it or special configuration other than allowing the web server 150 access to the desired file 110. However, in most deployments, it is unusual to allow a web server direct access to files of an internal workstation. In this case, the target file may need to be copied or moved to a location that is accessible to the web server.
The web server 150 responds to HTTP requests for the file or sections of the file coming from the local computer connected over the internet 160. This is accomplished through the use of a file proxy component 155 operating on the web server. The file proxy 155 on the web server 150 passes on I/O requests by opening and accessing the actual file on the remote workstation 120. Parameters may be passed in the HTTP request processed by the file proxy 150 to indicate the section of the file required by the requesting application.
On the local computer 170, an application 172 accesses the modified symbolic link 182 stored on a local disk volume 180, and is able to initiate access to the underlying file 110 as if it was stored on the local file system. The modified symbolic link 182 is like a regular symbolic link file in existing file systems, but is recognized as a modified symbolic link by a driver 174 operating on the local computing system 170. As sections of the file are accessed, the driver 174 redirects the I/O API calls through to HTTP (GET) requests on the web server 150.
1. Step 201: The first processing step occurs on the remote workstation where the target file exists. In an example where access is intended to be provided to a large core dump file, this would be the machine where the Virtual Machine or Operating System core dumped. On this remote machine, the user creates a modified symbolic link to the desired file. Unlike a regular symbolic link, this new kind of modified symbolic link is also a regular file that can be copied onto another system.
2. Step 202: The user takes steps to add connection information of the web server to the modified symbolic link file. In one embodiment, this may be performed by uploading the symbolic link file to the web server that is running a specialized software component, referred to as the “Web Server File Proxy”. In one embodiment of the present invention, the Web Server File Proxy operates to add the web server's DNS name to the symbolic link file, a generated URL unique for this file, and authentication information (which could be a time limited user name and password). In other embodiments, this connection information may be manually added to the modified symbolic link file by a system administrator, or may be added by a standalone program.
3. Step 203: The now completed modified symbolic link file is provided to the user and is placed on the local computing system. This local computing system is remote to the remote workstation, but has an internet connection to a web server connected to the remote workstation.
4. Step 204: The modified symbolic link file now exists on the local computing system, and the modified symbolic link file is accessed using an application. In one embodiment, a specialized file system driver operates on the local computing system to recognize a modified symbolic link file when opened and accordingly establish a connection to the web server.
5. Step 205: File access is then achieved by opening the connection to the web server using the connection and authentication information contained within the modified symbolic link file. This authentication information is then passed to the web server and processed. Once the connection has been opened and authenticated, the file system driver on the local computing system redirects all I/O requests through HTTP to the Web Server File Proxy operating on the web server.
6. Step 206: The Web Server File Proxy operating on the web server passes on I/O requests by accessing and opening the actual file on the remote workstation. In principle, the forwarding of I/O requests could be chained together through several servers if, for example, the traffic needs to be routed through a DMZ-style deployment. In this case, two File Proxies would communicate to pass on I/O requests. One File Proxy would be in the DMZ and have an external facing IP address, while the second would be inside the protected zone.
As described above, the Web Proxy File System Driver operating on the local computing system must detect which files are modified symbolic link files and which are not. This could be achieved by embedding the metadata (DNS name, URL, authentication information etc) in a special stream if the file system supports this feature (for example, NTFS supports streams). Alternatively, the symbolic link file could be a regular text document and rely on a particular file extension for identification.
Because file system requests are routed through HTTP, standard web technology and security protocols may be utilized. For example, the file system proxy driver can open a secure (HTTPS) connection to the server that is further authenticated using client and or server certificates. Secure connections may indeed be important since large files such as crash dumps can contain sensitive information including passwords and user names. These proxies are not required to use HTTP/HTTPS as their communication protocol, as they are optionally implemented with any equivalent communication protocol.
Although various representative embodiments of this invention have been described above with a certain degree of particularity, those skilled in the art could make numerous alterations to the disclosed embodiments without departing from the spirit or scope of the inventive subject matter set forth in the specification and claims.
The present application is a continuation application of U.S. patent application Ser. No. 12/058,808 filed Mar. 31, 2008, entitled “REDIRECTING FILE ACCESS THROUGH A HTTP WEB SERVER,” which is hereby incorporated by reference in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 12058808 | Mar 2008 | US |
| Child | 12334639 | US |
