Patent ID: 7774611

Claim:
A method of enforcing file authorization access, comprising: receiving, at a client computer, an encrypted authorization combination from a metadata server, the authorization combination comprising a block combination including a block list for accessing client requested data from a storage server system and an authorization prefix, the authorization prefix indicating at least one operation which the client computer is authorized to perform, wherein the authorization prefix is assigned a first value to indicate read access, a second value to indicate write access, and a third value to indicate mixed read and write access; transmitting, by the client computer, the encrypted authorization combination to the storage server system; and receiving the client computer requested data from the storage server system in response to the storage server system decrypting the encrypted authorization combination to recover the block list for retrieving the client requested data, wherein receiving the encrypted authorization combination comprises receiving the encrypted authorization combination that further comprises an encrypted token, the token including credentials for accessing the client requested data, and the token being encrypted using a session key shared by the metadata server and the storage server system, wherein the session key is unknown to the client computer so that the client computer is unable to decrypt the encrypted token.