Patent Application
20150067354
This application claims priority to Chinese Patent Application No. 201310376567.4 filed on Aug. 27, 2013 in the China Intellectual Property Office, the contents of which are incorporated by reference herein.
The present disclosure relates to management devices, and particularly to a storage management device and a method thereof.
Nowadays, some enterprises has a storage server to provided as a public storage device, each member of the enterprise can share data to other members via the public storage device. Usually, the public storage device is established and maintained by the enterprise.
Implementations of the present technology will now be described, by way of example only, with reference to the attached figures.
It will be appreciated that for simplicity and clarity of illustration, where appropriate, reference numerals have been repeated among the different figures to indicate corresponding or analogous elements. In addition, numerous specific details are set forth in order to provide a thorough understanding of one embodiment described herein. However, it will be understood by those of ordinary skill in the art that one embodiment described herein can be practiced without these specific details. In other instances, methods, procedures and components have not been described in detail so as not to obscure the related relevant feature being described. The drawings are not necessarily to scale and the proportions of certain parts may be exaggerated to better illustrate details and features. The description is not to be considered as limiting the scope of one embodiment described herein.
Several definitions that apply throughout this disclosure will now be presented. The term “module” refers to logic embodied in computing or firmware, or to a collection of software instructions, written in a programming language, such as, Java, C, or assembly. One or more software instructions in the modules may be embedded in firmware, such as in an erasable programmable read only memory (EPROM). The modules described herein may be implemented as either software and/or computing modules and may be stored in any type of non-transitory computer-readable medium or other storage device. Some non-limiting examples of non-transitory computer-readable media include CDs, DVDs, BLU-RAY, flash memory, and hard disk drives. The term “comprising” means “including, but not necessarily limited to”; it specifically indicates open-ended inclusion or membership in a so-described combination, group, series and the like.
Referring to
In at least one embodiment, each user group 200 includes a number of terminal devices 210 being used by a number of users of the user group 200. The terminal devices 210 can be mobile phones, tablet computers, portable computers, desktop computers, or the like. The user group 200 can be an enterprise, a school/university, or other organizations. The storage management device 100 can a single server or a server group. The storage devices 110 and the processing devices can be located entirely or partially external or internal relative to the storage management device 100.
The storage management device 100 communicates with the terminal devices 210 via the communication device 130. The communication device 130 can communicate via a wired or wireless connection, such as via a wifi or cellular network, or via a local area network or the Internet.
Referring also to
The request receiving module 10 can receive a creation request for creating a group storage space 31 from a user group 200, the creation request can include an identity of the user group 200 and a size of the group storage space 31. The identity of the user group 200 can be an enterprise registration number, unique group identifier, a name or label for the user group 200, or the like. In detail, a user of the user group 200 can access a webpage provided by the storage management device 100, and input information including the identity of the user group 200 and the size of the group storage space 31 to submit the creation request.
Referring to
The storage gateway module 30 can control communications between the user group 200 and the storage devices 110 of the storage management device 100, and manage the usage of the storage spaces of the storage devices 110.
In one embodiment, the storage gateway module 30 includes a permission setting module 40 and an assignment management module 41.
The permission setting module 40 can set an administrator identity and permissions of the administrator. In detail, the permission setting module 40 assigns an administrator account, so that a user who logs in via the administrator account is an administrator, and thus sets the administrator identity. The permissions of the administrator set by the permission setting module 40 include, but are not limited to, a permission to create sub-group storage spaces 32, a permission to delete sub-group storage spaces 32, for example.
The assignment management module 41 is used to create or delete sub-group storage spaces 32 and personal storage spaces 33 in the group storage space 31. For example, as shown in
In at least one embodiment, the sub-group storage space 32 can be a storage space assigned to a department of an enterprise or a college of a university, for example, or any other actual or logical group of users. The personal storage spaces 33 can be a storage space assigned to a member of the enterprise or a student/teacher of the university, for example.
In at least one embodiment, the permission setting module 40 can further set an access permission of each storage space such as the sub-group storage space 32 and the personal storage space 33. In detail, the assignment management module 41 sets the access permission of the personal storage space 33 as the personal storage space 33 only can be accessed by the corresponding user, and sets the access permission of the sub-group storage space 32 as the sub-group storage space 32 can be accessed by users belong to the corresponding department.
The permission setting module 40 can further establish a group public space 34 in response to an operation of the administrator, and set the access permission of the group public space 34 as the group public space 34 can be accessed by all users of the user group 200.
Therefore, each user can access his/her personal storage space 33, the sub-group storage space 32 corresponding to the department that the user belongs to, and the group public space 34. Therefore, the permission setting module 40 sets the access permission for each user by setting the access permission of each storage space.
In another embodiment, the permission setting module 40 further can change a sub-group storage space 32 that one user can access that space in response to an operation of the administrator. For example, if the user changes to another department, then the permission setting module 40 disables the sub-group storage space 32 corresponding to the previous department to be accessed by the user, and sets the sub-group storage space 32 corresponding to the new department to be accessed by the user.
According to the present disclosure, the user group 200 can utilize the storage source provided by the storage management device 100, and do not need to buy storage servers and maintain the storage servers.
In at least one embodiment, the storage gateway module 30 further includes a login verification module 50, an access control module 60, an encryption and decryption module 70, and a storage control module 80.
The login verification module 50 can verify the identity of the user in response to a login operation of the user. In at least one embodiment, the login verification module 50 verifies the identity of the user via a user account and password input by the user. The login verification module 50 verifies the user is a valid, authorized, or approved user upon determining that the user account and password input by the user are correct.
The access control module 60 can determine to which storage spaces the user has the access permission according to the identity of the user when the login verification module 50 verifies the user is the authorized user, and then manage access for those storage spaces according to the identity and permissions. In detail, the access control module 60 determines the storage spaces to which the user has the access permission according to the access permission of each storage space set by the permission setting module 40. In another embodiment, the identity of each user associates with corresponding permitted storage spaces, the access control module 60 determines the storage spaces corresponding to the identity of the user as the storage spaces the user has the access permission to.
In at least one embodiment, the access control module 60 manages access for the storage spaces as follows: when the access control module 60 determines the storage spaces to which the user has the access permission, the access control module 60 controls to only display the storage spaces to which the user has the access permission when the user logins in the group storage space 31.
In another embodiment, the access control module 60 manages accessing for the storage spaces as follows: the access control module 60 controls to display all of the storage spaces of the group storage space 31 when the user logins in the group storage space 31, and determines whether the user has the access permission to access one storage space when the user request to access the storage space. The access control module 60 further allows the user to access the storage space when the user has access permission to access the storage space, and forbids the user to access the storage space when the user does not have the access permission to access the storage space.
The encryption and decryption module 70 can obtain a group secret key of the user group 200 to which the user belongs when the user stores data to a target storage space of the corresponding group storage space 31 that the user have access permission. The encryption and decryption module 70 then encrypts the data by using the group secret key. In at least one embodiment, the group secret key is associated to the corresponding user group 200 and is taken as the secret key used by all users of the user group 200. In one embodiment, the group secret key is also associated to a storage gateway address of the corresponding storage gateway.
The storage control module 80 can store the encrypted data to the target storage space. For example, when the user stores a file to his or her personal storage space in response to a paste operation, a drag operation, or other file manipulation command, the encryption and decryption module 70 encrypts the file by using the group secret key. The storage control module 80 then stores the encrypted file to the target storage space.
In at least one embodiment, the encryption and decryption module 70 further decrypts the data when the user accesses the data of the storage space for which the user has access permission.
In at least one embodiment, the storage spaces are displayed on the terminal device 210 in icons of disks, files, or the like, when the user logins the group storage space 31 via the terminal device 210.
In at least one embodiment, the data of the personal storage space 33, the group public space 34, and the sub-group storage space 32 are all stored in the group storage space 31 assigned by the storage management device 100. The group storage space 31 is logically divided to different storage spaces, such as the personal storage space 33, the group public space 34, and the sub-group storage space 32. This logical arrangement or grouping can be completely independent of the underlying data storage structure.
In at least one embodiment, the storage gateway address can be a file transfer protocol (FTP) file address, a website address, or the like. The user can input the storage gateway address to enter a login interface of the group storage space 31, the user then can input the user account and the password to login the group storage space 31.
In at least one embodiment, as shown in
In at least one embodiment, the creation request received by the request receiving module 10 further includes an enterprise gateway address, the creation module 20 further associates the enterprise gateway address with the storage gateway address and the identity of the user group 200. The login verification module 50 further obtains the enterprise gateway address when the user logins the group storage space 31, and further verifies the identity of the user according to the enterprise gateway address. In details, the login verification module 50 obtains an enterprise gateway address account from the user account and an enterprise gateway address input by the user, and determines whether the two obtained enterprise gateway addresses are the same. The login verification module 50 verifies the user is an authorized user when determining the two enterprise gateway addresses are the same and the user account and the password are correct.
In at least one embodiment, a storage management method includes a storage assignment management method and a storage accessing management method.
In block 401, a request receiving module determines whether the request receiving module receives a creation request for creating a group storage space from a user group, the creation request includes an identity of the user group and a request size of the group storage space 31. If yes, the process jumps to block 403, if not, the process returns to block 401.
In block 403, a creation module assigns a group storage space with the request size from the storage management device to the user group and assigns a corresponding storage gateway address to the user group, and further associates the group storage space and the corresponding storage gateway address with the identity of the user group.
In block 405, a permission setting module sets an administrator identity of the group storage space and permissions of an administrator with the administrator identity. In detail, the permission setting module assigns an administrator account, and a user logins via the administrator account is the administrator with the administrator identity, thus to set the administrate identity.
In block 407, an assignment management module creates or deletes sub-group storage spaces and personal storage spaces in the group storage space in response to operations of the administrator.
In at least one embodiment, the storage assignment management method can further include: the permission setting module further changes a sub-group storage space that one user can access in response to an operation of the administrator.
The storage assignment management method can further include: the permission setting module further sets an access permission of each storage space. In detail, the assignment management module sets the access permission of the personal storage space as only can be accessed by the corresponding user, and sets the access permission of the sub-group storage space as can be accessed by users belongs to the corresponding department.
In block 501, a login verification module verifies an identity of a user in response to a login operation of the user. In detail, the login verification module verifies the identity of the user via a user account and a password input by the user, and verifies the user is an authorized user when determining the user account and the password input by the user are correctly
In block 503, an access control module determines to which storage spaces the user has the access permission according to the identity of the user when the login verification module verifies the user is the authorized user.
In block 505, an encryption and decryption module obtains a group secret key of the user group that the user belongs to when the user stores data to a target storage space of the corresponding group storage space that the user has access permission.
In block 507, a storage control module stores the encrypted data to the target storage space.
The storage accessing management method can further include: the encryption and decryption module further decrypts data according to the group secret key when the user accesses the data of the storage space for which the user has access permission. The group secret key can be any suitable cryptographic key, and can be based on biometrics, cryptographic cards, or passwords, for example. The group secret key can be a symmetric or an asymmetric key, and can be part of a key scheme in which individual users have distinct keys that provide access to respective resources, while the group secret key provides access to resources for the entire group, for example.
The storage accessing management method can further include: the access control module controls to only display the storage spaces that the user has the access permission to when the user logins in the group storage space.
The storage accessing management method can further include: the access control module controls to display all of the storage spaces of the group storage space when the user logins in the group storage space, and determines whether the user has the access permission to access one storage space when the user request to access the storage space; the access control module then allows the user to access the storage space when the user have the access permission to access the storage space, and forbids the user to access the storage space when the user does not have the access permission to access the storage space.
In another embodiment, in the block 401, the creation request received by the request receiving module further includes an enterprise gateway address; in the block 403, the creation module further associates the enterprise gateway address with the storage gateway address and the identity of the user group. In the block 501, the login verification module further obtains the enterprise gateway address when the user logins the group storage space, and further verifies the identity of the user according to the enterprise gateway address. In details, the login verification module obtains an enterprise gateway address from the user account and an enterprise gateway address input by the user, and determines whether the two obtained enterprise gateway addresses are the same; the login verification module verifies the user is the authorized user when determining the two enterprise gateway addresses are the same and the user account and the password are correctly.
It is believed that the present embodiments and their advantages will be understood from the foregoing description, and it will be apparent that various changes may be made thereto without departing from the spirit and scope of the disclosure or sacrificing all of its material advantages, the examples hereinbefore described merely being exemplary embodiments of the present disclosure.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2013103765674 | Aug 2013 | CN | national |
