Patent Application
20080071804
The accompanying figures where like reference numerals refer to identical or functionally similar elements throughout the separate views, and which together with the detailed description below are incorporated in and form part of the specification, serve to further illustrate various embodiments and to explain various principles and advantages all in accordance with the present invention.
As required, detailed embodiments of the present invention are disclosed herein; however, it is to be understood that the disclosed embodiments are merely exemplary of the invention, which can be embodied in various forms. Therefore, specific structural and functional details disclosed herein are not to be interpreted as limiting, but merely as a basis for the claims and as a representative basis for teaching one skilled in the art to variously employ the present invention in virtually any appropriately detailed structure. Further, the terms and phrases used herein are not intended to be limiting; but rather, to provide an understandable description of the invention.
The terms “a” or “an”, as used herein, are defined as one or more than one. The term plurality, as used herein, is defined as two or more than two. The term another, as used herein, is defined as at least a second or more. The terms including and/or having, as used herein, are defined as comprising (i.e., open language). The term coupled, as used herein, is defined as connected, although not necessarily directly, and not necessarily mechanically. The terms program, software application, and the like as used herein, are defined as a sequence of instructions designed for execution on a computer system. A program, computer program, or software application may include a subroutine, a function, a procedure, an object method, an object implementation, an executable application, an applet, a servlet, a source code, an object code, a shared library/dynamic load library and/or other sequence of instructions designed for execution on a computer system.
Distributed Processing Cluster System
According to an embodiment of the present invention, as shown in
The nodes of each cluster are connected via a data communications network 138 that supports data communications between nodes that are part of the same cluster and that are part of different clusters. In this example, the clusters are geographically removed from each other and are interconnected by an inter-cluster communications system 140. The inter-cluster communications system 140 connects the normally higher speed data communications network 138 that is included within each cluster.
The inter-cluster communications system 140 of the exemplary embodiment utilizes a high speed connection. Embodiments of the present invention utilize various inter-cluster communications systems 140 such as conventional WAN architectures, landline, terrestrial and satellite radio links and other communications techniques. Embodiments of the present invention also operate with any number of clusters that have similar interconnections so as to form a continuous communications network between all nodes of the clusters. Embodiments of the present invention also include “clusters” that are physically close to each other, but that have processing nodes that do not have access to resources in the same resource pool. Physically close clusters are able to share a single data communications network 138 and not include a separate inter-cluster communications system 140.
Other resources that can be included within a cluster but that are not shown in
Information associated with these storage disks such as disk name and the server where the disk is located can reside within the database 114, 126. Each node 108, 110, 112, within a cluster 102 has access to the same information. For example, the information residing in the database 114 and the filesystems 116, 118 is accessible by each node 108, 110, 112 in the cluster 108. Each filesystem 116, 118 in a cluster 102 is managed by one or more of the nodes. For example, the filesystem 1116 is managed by Node A1 108 and the filesystem 2118 is managed by Node A2 110. In other words, Node A1 108 created the filesystem 1116 and Node A2 110 created the filesystem 2118. Each managing node 108, 110 comprises a filesystem access manager for managing its given filesystem 116, 118. The managing nodes 120, 122 of Cluster C 106 also include filesystem access managers 150, 152 for managing filesystem 3128 and filesystem 1130, respectively.
The filesystem managers 142, 144 allow for selective and dynamic access control to the respective filesystem 116, 118. For example, when an administrator of a managing node such as Node A1 108 creates a filesystem 116, the administrator identifies the other clusters 104, 106 existing in the distributed processing cluster system 100. Through the filesystem access manager 142, the administrator can set different permissions and access rights for each remote cluster 104, 106 with respect to the filesystem 1116. Permissions either grant or deny a user access to a filesystem. Access rights define the type access such as read, write, or read and write that a remote cluster has with respect to a filesystem. A remote cluster is defined as a cluster not comprising the filesystem to be accessed. A home cluster is defined as a cluster comprising the filesystem to be accessed. It should be noted that permissions and access rights can be granted/denied manually by an administrator through a filesystem access manager or automatically by the filesystem access manager itself. It should be noted that in additional embodiments, a node within a cluster can set permissions and access rights and not just a managing node. In these embodiments, the managing nodes only enforce the permissions and access rights.
With respect to filesystem 1116, the filesystem 1 access manager 142 can deny access to filesystem 1116 to Cluster C 106, but grant access to filesystem 1116 to Cluster B 104. If a cluster is granted access to a filesystem, each node within the cluster has access to the filesystem. Similarly if a cluster is denied access to a filesystem, each node within that cluster is also denied access to the filesystem. As can be seen from
Permissions and access rights for remote clusters can be stored in the database 114. For example, a filesystem access table(s) associated with each filesystem 116, 118 created when a filesystem is created. Alternatively, a master filesystem access table can be created that comprises access right information for each filesystem in the cluster. As the filesystem access manager creates permissions and access rights the filesystem access table(s) is updated. A managing node 108, 110 accesses these tables when determining if a requesting remote node has permissions and access rights for a given filesystem. The information associated with filesystem access table can be streamed from the database 114 or the managing node 108, 110 can keep a local copy such as filesystem 1 access table(s) 146 and filesystem access table(s) 148 shown in
Now consider an example where Cluster A 102 is a home cluster and Cluster B 104 is a remote cluster. In other words, Cluster A 102 comprises a filesystem that one or more nodes in Cluster B 106 want to access. When Cluster A receives a request from a node in Cluster B such as Node B1 132 for mounting filesystem 1116, Node A1, which is the managing node of filesystem 1116, analyzes the request. A request for mounting a filesystem can include, but is not limited to, a filesystem identifier, a requesting node identifier, and the like. The filesystem identifier notifies the home cluster of which filesystem that the remote node wants to access and the requesting node identifier helps the managing node authenticate the requesting node. For example, Node A1 communicates with Cluster B 106 to verify that Node B1 is authenticated. Node A1 108 then analyzes the filesystem 1 access table 146 to determine whether Node B1 132 has permission to access the filesystem 1. If Node B1 132 does not have permission, the Node A1 108 denies the mounting request.
If Node B1 132 has permission, Node A1 108 then grants the mounting request. However, in some instances, the remote node might request access that it does not have. For example, if Node B1 132 only has read access to the filesystem 1116 but request write access, Node A1 108 can either deny the request or allow the request, but only for the authorized access of reading. If the request is denied Node A1 108 can notify Node B1 132 of the reasons it was denied and specify what access rights Node B1 132 so it can resubmit its request with the correct access type.
Exemplary Filesystem Access Table
The filesystem access table 200, in one embodiment, comprises various columns such as a “Cluster” column 202, a “Filesystem Name” column 204, and a “Filesystem Access Rights” column 206. The Cluster column 202 comprises the identity of a cluster. For example, a first entry 208 under the Cluster column 202 includes “B” for identifying cluster B 104. The Filesystem Name column 204 comprises entries including a filesystem identifier. For example, a first entry 210 under the Filesystem Name column 204 includes “Filesystem 1” for identifying filesystem 1116. The “Filesystem Access Rights” column 206 includes entries for identifying the access right of a cluster identified under the Cluster column 202 for a given filesystem under the Filesystem Name column 204.
For example,
Additionally, the filesystem access table 200 can also include every remote cluster identified as compared to only remote clusters having an access right type. In this embodiment, filesystem access table 200 can have an additional column labeled “Permission”, which indicates if a cluster has permission to access a listed filesystem. Therefore, in this embodiment, a node manager can directly determine if a cluster has rights as compared to negatively (i.e. the cluster does not exist in the table for a filesystem so therefore it does not have permission or rights) determining that rights do not exist for a cluster. It should be noted that other columns and information can be included within the filesystem access table 200 than what is shown in
Exemplary Architecture For the Distribute Processing Cluster System
Exemplary Information Processing System
The main memory 320, in one embodiment, includes the filesystem access manager 142 and a filesystem access table(s) 146, as discussed above. Although only one CPU 324 is illustrated for computer 402, computer systems with multiple CPUs can be used equally effectively. Embodiments of the present invention further incorporate interfaces that each includes separate, fully programmed microprocessors that are used to off-load processing from the CPU 324. The terminal interface 406 is used to directly connect the information processing system 104 with one or more terminals 412 to the information processing system 104 for providing a user interface to the computer 402. These terminals 412, which are able to be non-intelligent or fully programmable workstations, are used to allow system administrators and users to communicate with the information processing system 108. A terminal 412 is also able to consist of user interface and peripheral devices that are connected to computer 402.
An operating system image 312 included in the main memory 320 is a suitable multitasking operating system such as the Linux, UNIX, Windows XP, and Windows Server 2003 operating system. Embodiments of the present invention are able to use any other suitable operating system. Some embodiments of the present invention utilize architectures, such as an object oriented framework mechanism, that allows instructions of the components of operating system (not shown) to be executed on any processor located within the information processing system 108. The network adapter hardware 106 is used to provide an interface to the network 138. Embodiments of the present invention are able to be adapted to work with any data communications connections including present day analog and/or digital techniques or via a future networking mechanism.
Although the exemplary embodiments of the present invention are described in the context of a fully functional computer system, those skilled in the art will appreciate that embodiments are capable of being distributed as a program product via a CD/DVD, e.g. CD 410, or other form of recordable media, or via any type of electronic transmission mechanism.
Exemplary Process Of Assigning Filesystem Access Permission and Access Rights
For example, the filesystem access manager 142 can grant permission to select clusters for accessing to the filesystem, but deny other clusters permission to access. Additionally, the filesystem access manager 142 can grant different access rights to different remote clusters for a filesystem. Also a remote cluster can be granted a different permission and access rights for different filesystems within the home cluster. Once the permissions and access rights are set, the filesystem access manager 142, at step 512, updates the corresponding filesystem access table within the database 114. The control flow then exits at step 514.
Exemplary Process Of Controlling Access to A Filesystem
If the result of this determination is positive, the managing node, at step 614, determines if the requesting node has permission to access the filesystem. For example, the managing node analyzes the filesystem access table to determine if the requesting node has been granted permission to access the filesystem. If the result of this determination is negative, the managing node, at step 616, denies the mounting request. The control flow exits at step 618.
If the result of this determination is positive, the managing node, at step 620 determines the access rights of the requesting node. For example, the managing node analyzes the filesystem access table to determine the access rights granted to the requesting node. The managing node, at step 622, determines if the mounting request matches the access type granted to the requesting node. For example, if the mounting request is for read access to the filesystem, the managing node analyzes the filesystem access table to determine if the requesting node has read access to the filesystem.
If the result of this determination is positive, the managing node, at step 624, grants the mounting request. The control flow exits at step 626. If the result of this determination is negative (e.g., the mounting request is for an access right not granted to the requesting node) the managing node, at step 628, allows the request, but only for the granted access right(s). For example, if the access right granted to the requesting node is for read access, but the mounting request is for read/write access, the managing node allows the request but only for the read access. The control flow exits at step 630. Alternatively, optional steps can be taken by the managing node as shown by the dashed box. If the request does not match the access rights granted to the requesting node, the managing node, at step 632, denies the request. The managing node, at step 634, notifies the requesting node of the denial and of its granted access rights. This allows the requesting node to resubmit its request with the correct access type request. The control flow exits at step 636.
Non-Limiting Examples
The present invention as would be known to one of ordinary skill in the art could be produced in hardware or software, or in a combination of hardware and software. However in one embodiment the invention is implemented in software. The system, or method, according to the inventive principles as disclosed in connection with the preferred embodiment, may be produced in a single computer system having separate elements or means for performing the individual functions or steps described or claimed or one or more elements or means combining the performance of any of the functions or steps disclosed or claimed, or may be arranged in a distributed computer system, interconnected by any suitable means as would be known by one of ordinary skill in the art.
According to the inventive principles as disclosed in connection with the preferred embodiment, the invention and the inventive principles are not limited to any particular kind of computer system but may be used with any general purpose computer, as would be known to one of ordinary skill in the art, arranged to perform the functions described and the method steps described. The operations of such a computer, as described above, may be according to a computer program contained on a medium for use in the operation or control of the computer, as would be known to one of ordinary skill in the art. The computer medium, which may be used to hold or contain the computer program product, may be a fixture of the computer such as an embedded memory or may be on a transportable medium such as a disk, as would be known to one of ordinary skill in the art.
The invention is not limited to any particular computer program or logic or language, or instruction but may be practiced with any such suitable program, logic or language, or instructions as would be known to one of ordinary skill in the art. Without limiting the principles of the disclosed invention any such computing system can include, inter alia, at least a computer readable medium allowing a computer to read data, instructions, messages or message packets, and other computer readable information from the computer readable medium. The computer readable medium may include non-volatile memory, such as ROM, Flash memory, floppy disk, Disk drive memory, CD-ROM, and other permanent storage. Additionally, a computer readable medium may include, for example, volatile storage such as RAM, buffers, cache memory, and network circuits.
Furthermore, the computer readable medium may include computer readable information in a transitory state medium such as a network link and/or a network interface, including a wired network or a wireless network that allows a computer to read such computer readable information.
Although specific embodiments of the invention have been disclosed, those having ordinary skill in the art will understand that changes can be made to the specific embodiments without departing from the spirit and scope of the invention. The scope of the invention is not to be restricted, therefore, to the specific embodiments, and it is intended that the appended claims cover any and all such applications, modifications, and embodiments within the scope of the present invention.
