FLEXIBLE RESOURCE MANAGEMENT FOR MULTIPLE USERS

Description

TECHNICAL FIELD

[0001] The invention disclosed here lies in the technical field of managing technical resources, for example the allocation of storage space, for multiple users. BACKGROUND

[0002] Resources for multiple users are typically managed by a central server that users can access from their devices. Such access occurs, for example, via a web browser or similar client-server software. Such centralized data management is referred to as a cloud. Access to such a server is typically subject to access restrictions and requires user authorization.

[0003] TW 2013 42869 discloses the generation of certificates of authenticity for data stored in a cloud. These certificates of authenticity are used to assign permissions for storage space. Attribute information is used to verify whether a specific device is authorized to access the storage space.

[0004] EP 1262930 discloses the transfer of an authorization to a mobile device, which authorization enables the use of this mobile device to access a specific transaction system. The authorization comprises data that defines a specific product or service.

[0005] US 2003 / 126394 A1 discloses: A system and method for remotely configuring storage space in multiple storage devices. The multiple storage devices include free storage space and storage space allocated to a user for storing the user's data, wherein the user is located at a location remote from the storage devices. A portion of the free storage space is automatically transferred to the allocated storage space when the remote user requests an increase in the allocated storage space.

[0006] US 2021 / 124509 A1 discloses: Storage management techniques include determining a plurality of target users with storage quotas to be updated from a group of users sharing a storage system; obtaining a total storage quota for the storage system to be increased; and determining the allocation of the total storage quota among the plurality of target users according to at least a first strategy associated with quota shares and a second strategy associated with utilized storage capacity. The allocation of the increased storage quota is automatically determined according to one or more predefined strategies, whereby effective and automatic allocation of storage quotas can be achieved, thereby increasing storage efficiency.

[0007] US 2010 / 030578 A1 discloses: The methods and systems described herein relate to online collaboration methods in collaborative environments. The methods and systems relate to an online clothing modeling system that allows users to have three-dimensional models of their physical profile created. Users can purchase various goods and / or services and collaborate with other users in the online environment.

[0008] The invention is based on the object of efficiently managing resources for multiple users. SUMMARY

[0009] The invention is defined by the appended claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The Figure 1A and 1B show examples of processes according to the invention. DETAILED DESCRIPTION

[0011] Embodiments of the invention disclosed here serve to manage technical resources for multiple users. The resources can include, for example, storage space on a server or access to specific data on a server. The server can be, for example, a cloud server or any web server accessible via HTTP. In particular, the server can have a user database in which access data is stored, for example, user names and passwords, and possibly also unique identifiers for the users. These access data are specified by users when they register with the server and / or suggested by the server during registration.

[0012] Users can log in to the server, and the server can grant them access to certain resources. The server's user database (or a separate database or other data structure) can specify the extent to which individual users are permitted to access certain resources (quota). This quota can be specified, for example, in the form of a memory limit and, optionally, a currently used amount of memory. The server only permits a user to access memory if the data to be stored does not exceed a certain total remaining volume or remaining volume for the user.

[0013] In one embodiment, the invention relates to a method. The method begins with a user logging in to the server, for example by entering a user name and password into a web page of the server that is displayed in a user's browser. This login process can alternatively be performed by entering other or additional data, for example by entering a fingerprint scan, iris scan, or the like, and can also be automated, for example by using login data stored in the browser that is automatically transmitted by the browser when the web page is accessed. User inputs into a web page displayed in the browser are made using a terminal device, for example a desktop computer or smartphone, or generally using a network-capable device.

[0014] The further steps of the method serve to define a resource by the user with the aim of allowing another user access to this resource. To do this, the user first enters information about the resource to be released: For example, the user can fill out a form on the website that specifies the size of the resource to be released, perhaps using the unit of measurement bytes. To support the user in this process, the website can provide a slider in the form that allows a specific number of bytes to be selected. Preferably, the maximum selectable amount corresponds to the quota assigned to the current user, and the minimum selectable amount corresponds to zero. Alternatively, this range can be between the amount of memory used by the current user and the remaining amount of memory for this user.As a further alternative, the user can enter a free amount of bytes without such a control, for example in a corresponding text field, or can select a range from a graphical representation of his resources, for example by selecting a circular sector from a circle symbolizing the user's resources.

[0015] In addition, the user also specifies the user for whom the resource should be released to the specified extent, as well as a time period within which the other user may access the resource. The user's details can include their email address or their username stored on the server. The time period can be specified as a one-dimensional value (examples: 24 hours; five weeks; three months, etc.) or as an absolute start and end time (example: October 26, 2021, 4:35 p.m., to October 26, 2022, 4:35 p.m.). Alternatively, a combination can be defined, for example, five weeks from October 26, 2021, 4:35 p.m. These values can be freely defined in a text field or using one or more sliders (first slider for start time, second slider for end time), or even using a graphical daily / weekly / monthly and / or annual overview.If the current user is subject to a time restriction, these elements can restrict the selection of the duration to the duration applicable to the current user or their resources, allowing only this value as the maximum selectable end time. The current time is considered the minimum start time.

[0016] The server creates a digital object from this data. This object can be a file, a database entry, a data structure stored solely in memory, a BLOB (Binary Large Object), or similar. In one embodiment, the object is or contains a URI (Unified Resource Identifier). This object contains the aforementioned information regarding the scope of the resource to be released and the time duration, optionally also a name for the user to whom the resource is to be transferred. The object also contains information about the current user, for example, their user name or identifier. This can serve as the user's identifier on the server side; alternatively, a unique identifier can be used in addition to the user name, which is associated with the user name, for example, in the database.

[0017] The creation of the digital object may include a check to determine whether the size of the resource to be released is within the resource size assigned to the current user or assigned to this user as an unused resource (free storage space). If this condition is not met, the process can be aborted or the size can be reduced to the (remaining free or total) resource size of the current user. However, this check is optional and, in particular, not required if a limitation to the resource size of the current user was already enforced when entering the resource size to be released, for example, using the maximum values explained above.

[0018] In addition or alternatively to the aforementioned check, it can be determined whether the scope of resources to be released exceeds the scope of resources assigned to a group of users. In this embodiment, the invention distinguishes between identifiers or user names of individual users and identifiers for groups of users. A group identifier can, for example, designate employees of a company. User identifiers and group identifiers can be stored in the same database (user database), with a user identifier being associated (stored jointly) with one or more group identifiers, and with a group identifier being associated with one or more user identifiers. In this way, it can be determined for a user identifier which groups it belongs to, and for a group identifier it can be determined which users belong to this group.Groups can, like users, be associated with a resource scope. There are two ways to check whether the resource scope to be released by a user does not exceed the resource scope of a group. First, the resource scope to be released can be compared with the sum of the user's resource scope and the resource scope of their groups. Second, the resource scope to be released can be compared with the sum of the resources of all users in the current user's group(s). In this second example, it is sufficient if group identifiers in the database are only associated with users, but not with a resource scope for the entire group; this can be determined from the individual user identifiers. If the resource scope of the group exceeds the resource scope to be released, it can either be adjusted automatically or the process can be aborted.

[0019] The digital object is preferably encrypted, for example with a public key of the other user or target group, or with a public key of the server or a symmetric key of a key pair known only to the server, and is transmitted to the other user or users of the group, for example by sending an email or an instant message. Alternatively, the key or key pair can be specially generated and stored in the database / data structure with the relevant user(s) and / or group. The transmission medium (email or message) can contain, in addition to the encrypted object, information on its use, such as the server address and information on its content and / or instructions on how to use the object.In the following, the second user who receives the object is always understood to mean one or more groups of users, without this being explicitly stated. In principle, a user (second user) who releases a resource can specify one or more users and / or groups, and all recipients—i.e., users and / or groups and their users—can perform the steps described here to access the resource. However, the shared resource can only be used once, as explained below.

[0020] After receiving the digital object, the second user can log in to the server, possibly after completing an initial registration process, and transfers the digital object back to the server. This transfer can take place by uploading the object. Alternatively, the second user can activate a link provided in the email or message that loads the server's website in the user's browser and simultaneously transfers the digital object to the server. As a further alternative, the second user can directly execute the digital object in the email or message, thereby triggering the loading of the website and the transfer of the digital object. If the digital object contains a URI, executing the object involves calling this URI in a browser.

[0021] The server decrypts the digital object using the server's private key. Alternatively, the digital object can already be decrypted on the second user's side using the second user's private key. Alternatively, the server can decrypt the digital object using the server's symmetric key mentioned above. If the key is assigned to specific users, the server can retrieve the key from the respective user's entry in the database or data structure, and the process can be aborted if no key is available. In one embodiment, the key can be deleted after decryption.

[0022] The server then adjusts information about the resources of the first and second users to the information from the digital object. In one embodiment, this occurs immediately after decrypting the digital object; this applies in particular to embodiments in which the duration was specified as a one-dimensional value. However, if the duration includes a time starting point in the future, the adjustment only occurs when this point in time is reached.

[0023] If the first user specified multiple recipients, i.e., multiple users and / or groups, the server repeats the aforementioned steps each time one of the recipients executes the object. The adjustment of information about the assigned resources is performed analogously for each executing user, with the specific resource to be released being entered multiple times, namely for each of these recipients. For this purpose, the process can internally record precise information about the resource, such as memory addresses, for the participating users.

[0024] Adjusting the information by the server involves reducing the amount of resources available to the first user by the amount of resources specified in the digital object. At the same time, the amount of resources available to the second user is increased by this amount, if necessary (in an embodiment with multiple recipients) along with information on the specific addresses of the resource. The chronological sequence of this reduction or increase is also stored on both sides (first and second user), for example, by storing a current timestamp and the time duration, or by storing the start and end times. The server can also define an instruction that is executed when the time duration expires and reverses the reduction or increase. Such an instruction can be implemented on Unix systems, for example, using Cron or systemd. Alternatively, the server can implement a handler and execute it on the expiration date.As a further alternative, the server can check whether one or more time periods have expired in the meantime only when a user accesses the server and can make reductions / increases before this access.

[0025] Decreasing and incrementing values can be performed directly in the user database discussed above. Alternatively, a separate database can be provided that serves solely to track resource allocations. Another alternative is to use any data structure, such as a table.

[0026] Each time a user accesses the resources assigned to them, for example, by uploading data to the server, the server checks whether the specific access to the resources falls within the scope stored for the respective user. Access is denied if the scope is exceeded.

[0027] After the time period has elapsed, as already explained, the reduction or increase in the resource scope is reversed for both users, and the corresponding information in the user database or other data structure is adjusted accordingly. Subsequent user accesses to their resources are now checked against the new information and, if necessary, denied. As described, the expiration of a time period can be checked every time a user accesses their resources. Additionally, this can be checked before the first reduction or increase; in this case, the increase / reduction is aborted if the time period has already expired.Checking the duration involves comparing the current time with the time information in the database / data structure, for example, by adding a timestamp and a duration in the database / data structure and comparing the result with the current time. In one embodiment, keys required to decrypt the digital object can be deleted after the duration has elapsed.

[0028] The process can request the users involved, and in particular the users of any participating groups, to consent to certain steps of the process and can terminate if consent is refused. This request can be made, for example, before a change to resource information (reduction / increase) is made. In particular, the second user can be prompted accordingly. Such a request can also be made during the creation of the digital object, for example, if the first user is assigned to one or more groups and the resource to be released exceeds their own resources (not including the group resources).

[0029] The method described above can be carried out by any user known to the server. Each user can release resources to one or more users, including groups, within the scope of the resource allocated to them. This scope can, as described, be reset to its original scope after a certain period of time. For a single user, multiple increases / decreases can take effect, attributable to different users. Thus, the available resource scope for a user can change repeatedly. Chains of user relationships can also arise, in which each user in a chain releases resources for other users and receives these resources back after a certain period of time. The invention ensures that users can only ever access the currently allocated resource scope and ensures that resources can only be passed on / released within the scope available.

[0030] In one embodiment, in addition to reducing / increasing the resource scope of each user, the invention also includes specifying specific resources that are being passed on. For example, the first user can specify specific characteristics of the resource, such as specific directories, when entering details about the resource to be passed on. For the duration of the resource transfer to another user, the first user cannot then access the specific resource (directories). After the resource is returned (time has elapsed), the first user can access it again. In this way, the first user can allow the second user to edit data that is already part of this resource and can continue editing the data later.Furthermore, in this embodiment, it is possible to record, for example in the database / data structure, which users or groups a specific resource has currently been distributed to, and how much time remains until the resource is returned. The first user can view this data, for example, via the server's web page discussed above.

[0031] Further embodiments include computer-readable media having instructions stored thereon which, when executed by a processor, perform the steps of the above method. Furthermore, embodiments of the invention also include a server configured to perform the above method. The server is connected to terminal devices via a network and communicates with one or more users operating these devices. The server is, for example, an HTTP server and may be a software-based server and / or a standalone network-capable device. Embodiments of the invention further include a system comprising said server and one or more terminal devices, all interconnected via network connections.

[0032] The invention thus enables efficient management, allocation and sharing of resources between users.

[0033] Figure 1Ashows a method 100A according to the invention for transferring usage rights to a resource. The essential steps of the method are described below. However, the different embodiments described above can easily be combined with the steps described here. Conversely, details described with reference to Figure 1A described in the previous sections can be combined with the above-mentioned versions. Figure 1A for example, a "second user"; however, the steps relevant to that user may also be carried out sequentially or simultaneously for several second users, in particular for several users belonging to one or more groups.

[0034] The method 100A is essentially executed on a server and comprises the participation of a first user and a second user, who access the server, for example, via respective network-capable devices. The method 100A begins with the first user logging in 110 to the server. As already described, this can be done by entering a user name and password, either automatically via cookies and browser functionality or manually by the user themselves. The user is then directed to a web page of the server, which is displayed on the user's device and can be used to access the user's resources. In addition, the web page offers functionality for specifying a resource that the server manages and which the user has and which they wish to make available—in whole or in part—to one or more users or even a group of users.This functionality can be accessed, for example, by clicking on a link on the website. The user then defines the scope of the resource to be transferred, as well as the target user(s) and / or groups, and a time restriction, for example, a period of time within which the resource can be used by the other user, after which the resource reverts to the first user. In step 120, the server creates a digital object containing the information of the first user. The object is encrypted, step 125, and transmitted to the second user(s). The key used for encryption can, as already described, be a public key of the server, a public key of the second user (or a group to which this user belongs), a symmetric key of the server, or the like.In one embodiment, a key or key pair can be generated specifically for each such encryption. The key pair can be stored in the database in association with the target users and / or groups. In one embodiment, only the private key of an asymmetric key pair is stored in this way, and the public key is deleted immediately after encryption.

[0035] The second user(s) or the members of a group named in the object receive the object from the server. In order to access the resource defined in the object, the users must be registered and logged in with the server. This registration and / or login can be simplified by the recipient(s) executing the object, for example, by activating a URI that was transmitted with the object or that is called by executing the object, steps 130 and 140. The object can be transferred back to the server after registration has been completed. In one embodiment, both the transfer to the users and the transfer back to the server can be omitted, and the server instead identifies the object based on the names or identifiers of the now logged-in users.In such an embodiment, the object can be associated with the relevant users after its creation, for example in a database that also contains further information about the users.

[0036] The server decrypts the object in step 150, for example, using keys associated with the second user and stored in the database. If necessary, a check is already performed at this point to determine whether a time period defined in the object has already expired. The server reads the information regarding the resource to be released from the object and adjusts the resource rights of the first and second users in the database by reducing the resource scope of the first user by the resource scope of the object and by increasing the resource scope of the second user by the resource scope of the object (steps 160 and 165). The transfer of rights to the resource is thus completed.

[0037] Figure 1B shows another method 100B that reflects a user's access to its resources.

[0038] In step 170, one of the second users accesses resources managed by the server. The user must already be logged in to the server at this time. The server first checks whether the access exceeds the stored resource limit of the second user. It may also check whether this user's resource limit is subject to expiration, in whole or in part. If the latter condition is met, the resource limit is reduced by an amount specified in the database (stored after the object has been decrypted in method 100A), and the resource limit of the first user (also stored after the object has been decrypted in conjunction with the second user's resource limit) is increased accordingly, steps 185, 190, and 195.Only if the remaining resource scope of the second user still allows access after this measure will further processing be carried out; otherwise, access will be denied.

[0039] If multiple second users independently access a resource that was jointly assigned to them and whose time period has expired, the resource is retransferred as described upon the first of these accesses. In one embodiment, the retransfer (reduction and increment) can additionally be performed by retransferring all original recipients of the digital object, with the increment on the part of the first user and the reductions for all other users of the resource each being performed once. In this embodiment, it is possible to determine which other users are using this resource after the first access (and the determined expiration of the time period).For this purpose, during steps 150, 160 and 165 (decryption, reduction, increase) of the method 100A, it can be noted in the data structure in an entry of the first user for which users the resource has been released.

[0040] One advantage of the invention is that users can independently transfer rights to their resources to other users without the need for an intermediary. This is significantly more efficient than conventional methods for transferring rights and, due to the reduced number of transactions, also more secure. The invention enables the transfer of rights even if the target user is not yet known to the server; for this purpose, registration en passant is provided.

Claims

1. A method comprising: performing a login process at a server for a first user, wherein an identifier is assigned to the first user; performing a process for generating a digital object based on data entered by the first user at the server, wherein the data includes an indication of the amount of a resource, and wherein the digital object includes the identifier and the indication of the amount of the resource and a duration of time; encrypting the digital object and transmitting the digital object to a second user, wherein a destination address of the second user is indicated by the first user of the server; performing a registration or login process via the server for the second user in response to execution of the digital object by the second user; decrypting the digital object and reading the identifier of the first user and the indication of the amount of the resource and the duration of time; reducing an indication of the amount of the resource for the first user in a data structure by the indicated amount of the resource, and increasing an indication of the amount of the resource for the second user in the data structure by the indicated amount of the resource; storing the duration of time for the first user and the amount of the resource in the data structure, and storing the duration of time for the second user and the amount of the resource in the data structure; increasing the indication of the amount of the resource for the first user in the data structure after expiration of the duration of time for the first user, and reducing the indication of the amount of the resource for the second user in the data structure after expiration of the duration of time for the second user; wherein the resource comprises storage space on the server and / or accesses to data on the server.

2. The method of claim 1, wherein performing the process for generating the digital object comprises checking whether the amount of the resource exceeds the amount of the resource assigned to the first user; or wherein the first user belongs to a group of users determined based on the identifier of the first user and an identifier of the group, and wherein performing the process for generating the digital object comprises checking whether the amount of the resource exceeds the sum of the amount of the resource of all users assigned to the group.

3. The method of claim 1 or 2, wherein the digital object includes a URI, and wherein executing the digital object comprises operating the URI in a browser.

4. The method of any preceding claim, wherein storing a duration of time additionally comprises storing a current timestamp in the data structure.

5. The method of claim 4, further comprising checking whether the duration of time has expired before performing the increasing of the indication of the amount of the resource for the first user and the reducing of the indication of the amount of the resource for the second user, wherein the checking is performed based on a current timestamp and the duration of time stored in the data structure and an associated timestamp.

6. The method of any preceding claim, wherein transmitting the digital object is by email or by means of a messaging system.

7. The method of any preceding claim, wherein encrypting the digital object is by means of a key that is automatically generated for the first user and stored in the data structure, and wherein decrypting the digital object comprises using the key.

8. The method of claim 7, wherein the key is deleted after decrypting or after expiration of the duration of time, and wherein the method is aborted if the key is not present before decrypting the digital object.

9. The method of any preceding claim, wherein before or after decrypting the digital object, the method requests the second user to consent to an adjustment of his rights to the resource, and wherein the method is aborted if the second user does not consent.

10. A computer-readable medium having stored thereon instructions that, when executed by a processor, perform the method of any preceding claim.