Patent Application
20110270803
Embodiments of the present invention relate to computing systems, and more particularly, to Network Attached Storage (NAS) systems and cloud storage.
A network attached storage (“NAS”) system is a processing system adapted to store and retrieve data on behalf of one or more client processing systems (“clients”) in response to external input/output requests received from clients. A NAS system can provide clients with file-level access to data stored in a set of mass storage devices, such as magnetic or optical storage disks or tapes.
Configuration, maintenance, and support of a NAS system have evolved from simple NFS mount points to sophisticated support for multiple versions of NFS/CIFS.
As such, client file /mnt1/file1 on NAS client 102 corresponds to a file on NAS server 106 /vol/mnt1/file1. Similarly, client file z:\file2 on NAS client 102 corresponds to a file on NAS server 106 /vol/mnt2/file2.
NAS client 102 accesses files in /mnt1 based on security settings on each file 112, 114 or directory.
An administrator 108 of the NAS server 106 can create snapshots 110 of the NAS server 106 on a timely basis (hourly, daily, weekly). For example, snapshots 110 are then accessible under:
Access to most configurations of NAS server 106 are typically limited to either the administrator of the NAS server 106 and/or a user with specific rights to login to the NAS server 106 through a Web User Interface or a Command Line Interface for such configuration, support, and maintenance.
Sophisticated features added to NAS server 106 such as snapshots, mirroring, database synchronization, virtual machine provisioning, are not only useful to the administrator of NAS server 106, but these features have also become part of applications and end user's day to day operation needs. For instance, a user may frequently need to be able to snapshot and minor important data when large amounts of changes are done in his working set storage.
Conventionally, the user is either forced to submit a change request to the administrator 108 of NAS server 106 for such tasks or make use of NAS server 106 vendor-provided so called plug-ins 103 into the application to make use of this. Plug-ins 103 frequently have limited functionality and do not have as extensive security and rights attributes as the files that reside on them have. Plug-ins 103 also only exist for specific applications that the NAS Server 106 vendor supports. Also, plug-ins 103 are frequently for specific Operating Systems where the applications may run as they require binary builds of the specific feature.
The present invention is illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which:
A system for delegating commands for a network attached storage system is described. A command permission associated with a command to be executed on a Network Attached Storage (NAS) server is delegated to a user of a NAS client having a mounted network filesystem of the NAS server therein. The command is issued through the filesystem of the NAS client.
NAS server 206 includes for example, two exportable volumes: /vol/mnt1 and /vol/mnt2 that are mounted onto NAS client 202 respectively as /mnt1 and as a drive letter such as z:\.
As such, client file /mnt1/file1 on NAS client 202 corresponds to a file on NAS server 206 /vol/mnt1/file1. Similarly, client file z:\file2 on NAS client 202 corresponds to a file on NAS server 206 /vol/mnt2/file2.
In order for NAS client 202 to perform a command on NAS server 206 without intervention from the administrator on every occasion, an administrator of NAS server 206 delegate permission with respect to specific commands to NAS client 202 via a console of the NAS server (not shown) or another NAS client. Examples of commands that can be delegated include snapshots, mirroring, database synchronization, virtual machine provisioning among other end user's day to day operation needs. Those of ordinary skills in the art will recognize that other commands besides the previously mentioned can be delegated.
For illustration purposes,
echo “permit write user1”>z:\proc\snap
Another possible syntax of the commands include:
Echo “enable”>z:\proc\snap\permit?write?user1
The delegated commands are scriptable commands that can be issued from any client operating through the filesystem. Similar to commands issued in /proc under Linux, the use of the commands and status is expanded to NAS. So, for example, a command from NAS client 202 to take a snapshot of his directory based on the above system would be:
echo “snapshot”>/mnt1/proc/snap
NAS client 202 would then be able to access such snapshot 210 at /mnt1/proc/<date and time>/file1.
As such, the NAS commands (snapshots, mirroring, etc. . . . ) pass through in the same connection as the NAS is mounted through NFS/CIFS. There is no new additional port or connection, and no change on NAS client side itself. Furthermore, because all commands flow through the filesystem, no additional firewall rules between NAS client 202 and NAS server 204 need to be created or adjusted.
In another embodiment, NAS client 202 in turn delegates its delegated command permission from administrator 208 to another NAS client 214. This other NAS client 214 is then authorized to place the delegated command to NAS server 206 without requiring another permission from administrator 208.
Delegation of security attributes are already what the network filesystem supports (which has gone through IT security auditing). All users that can be delegated to already exist and can make use of such system (whether AD, Kerberos™, LDAP, Radius™ TACACS . . . no longer matters).
It should also be noted that plug-ins are no longer required in NAS client 202 to issue permitted commands to NAS server 206. Vendors associated with NAS server 206 no longer need to implement every possible sophisticated security feature or create application plugins for NAS 202.
Most applications such as databases, email/exchange, virtual machines such as VMWare or XEN, have built-in scripting inside the application itself. Thus, a very simple end-user can create a script that to manage the NAS server. The vendor of NAS server 206 is no longer needed to create and support such tasks in allowing application integration. The integration can now be done by an end-user of NAS client 102, VAR, or outsourced groups from the vendor or partner.
NAS client interface 304 is configured to communicate with NAS client 202. For example, NAS client interface 304 can include a network interface card or module.
Processing device 306 represents one or more general-purpose processing devices such as a microprocessor, central processing unit, or the like. More particularly, the processing device may be complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or processor implementing other instruction sets, or processors implementing a combination of instruction sets. Processing device 306 may also be one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like.
Processing device 306 comprises a delegation module 310 and a command engine 312. Delegation module 310 is configured to delegate a command permission associated with a command to be executed on networked storage device 308 to a user of a NAS client having a mounted network filesystem of NAS server 302 therein.
Command engine 312 is configured to receive a command at the filesystem level of the NAS client and client interface 304 or at a protocol level of the NAS client. Command engine can also executes the command on networked storage device 308, and communicates a result of the executed command back to the NAS client. For example, the command includes taking and accessing a snapshot of at least a portion of the networked storage device 308.
In one embodiment, delegation module 310 is configured to communicate with an administrator of the NAS server who is accessing the NAS server from another NAS client. In another embodiment, delegation module 310 receives a command from another NAS client that has been delegated the command permission from an NAS client with the delegated command permission.
Networked storage device 308 is configured to store data to be accessed by NAS clients. In one embodiment, networked storage device 308 includes a memory or a data storage device. Memory can include a read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM), or a static memory (e.g., flash memory, static random access memory (SRAM), etc.). Data storage device may include a computer-accessible storage medium on which is stored one or more sets of instructions embodying any one or more of the methodologies or functions described herein.
Delegation module 310 and command engine 312 may also reside, completely or at least partially, within a main memory and/or within the processing device 306 during execution thereof by NAS server 102. The main memory and the processing device 306 also constitute computer-accessible storage media. The software may further be transmitted or received over a network via the network interface device.
At 404, NAS server receives the command at the filesystem level or protocol level of the NAS client with delegated command permission. In another embodiment, the NAS client with delegated command permission can delegate the command permission to another NAS client. Delegation may include forming a pseudo filesystem on the NAS client for the delegated command.
In one embodiment, NAS server executes the command and communicates the result of the command to NAS client.
In one embodiment, delegating is performed with an administrator of the NAS server accessing the NAS server from another NAS client.
While the computer-accessible storage medium is shown in an exemplary embodiment to be a single medium, the term “computer-accessible storage medium” should be taken to include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more sets of instructions. The term “computer-accessible storage medium” shall also be taken to include any medium that is capable of storing, encoding or carrying a set of instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the present invention. The term “computer-accessible storage medium” shall accordingly be taken to include, but not be limited to, solid-state memories, optical and magnetic media.
In the above description, numerous details are set forth. It will be apparent, however, to one skilled in the art, that the present invention may be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring the present invention.
Some portions of the detailed descriptions above are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.
It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the following discussion, it is appreciated that throughout the description, discussions utilizing terms such as “processing” or “computing” or “calculating” or “determining” or “displaying” or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.
The present invention also relates to apparatus for performing the operations herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer readable storage medium, such as, but is not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, and each coupled to a computer system bus.
The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear from the description below. In addition, the present invention is not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the invention as described herein.
It is to be understood that the above description is intended to be illustrative, and not restrictive. Many other embodiments will be apparent to those of skill in the art upon reading and understanding the above description. The scope of the invention should, therefore, be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.
