Policy engine to control the servicing of requests received by a storage server

• US 20040230795A1
• Filed: 02/11/2004
• Published: 11/18/2004
• Est. Priority Date: 12/01/2000
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Thompson, Timothy J., Yoder, Alan G., Muhlestein, Mark, Uren, James T., Armitano, Robert M., Mihajlovic, Dejan L.
• Granted Patent: US 7,778,981 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Certain tasks are outsourced from a filer to a remote policy engine. The policy engine implements various defined policies to control the filer'"'"'s servicing of client requests. For example, the policy engine can be used to implement policies to control various storage-related operations relating to data managed by a filer, such as creation, deletion, modification, opening, closing, renaming and/or changing attributes of files or directories managed by the filer.

Claims

1. A method of operating a storage server, the method comprising:

receiving at the storage server, from a client, a first request to perform a storage-related operation relating to a set of data;

generating a second request in the storage server if the first request satisfies a defined criterion;

sending the second request and information relating to the set of data from the storage server to a policy engine;

receiving at the storage server, from the policy engine, a first response indicating a result of the policy engine having implemented a defined policy based on the information relating to the set of data; and

sending a second response in accordance with the first response from the storage server to the client.

2. A method as recited in claim 1, wherein the policy engine is external to the storage server.

3. A method as recited in claim 1, wherein the storage server and at least a portion of the policy engine are implemented in a single physical platform.

4. A method as recited in claim 1, wherein the first request is a request for a file managed by the storage server.

5. A method as recited in claim 1, wherein the first request is a request to create a file.

6. A method as recited in claim 3, wherein the policy engine approves or denies the request to create the file based on a file type of the file.

7. A method as recited in claim 4, wherein the file type of the file is indicated in the information relating to the set of data.

8. A method as recited in claim 1, wherein the defined criterion has been defined in the storage server by the policy engine.

9. A method as recited in claim 1, wherein the policy engine determines whether to approve or deny the second request based on an identity of the client.

10. A method as recited in claim 1, wherein the policy engine determines whether to approve or deny the second request based on an identity of a user of the client.

11. A method as recited in claim 1, wherein the policy engine determines whether to approve or deny the second request based on an identity of the storage server.

12. A method as recited in claim 11, wherein the information relating to the set of data comprises information specifically identifying the storage server from among a plurality of storage servers that are coupled to the policy engine.

13. A method as recited in claim 1, wherein the policy engine determines whether to approve or deny the second request based on a quota.

14. A method as recited in claim 1, wherein the policy engine determines whether to approve or deny the second request based on a number of times the set of data has been accessed during a period of time.

15. A method as recited in claim 1, wherein the storage server defers sending the client any response to the first request until the storage server receives the first response from the policy engine.

16. A method as recited in claim 1, further comprising:

responding to the first request at the storage server by using metadata in the storage server to determine that the set of data is stored externally to, and remotely from, the storage server;

wherein the policy engine responds to the second request by retrieving the set of data from storage and provides the set of data to the storage server in conjunction with the first response.

17. A method as recited in claim 1, further comprising:

using one of a plurality of storage protocols implemented by the storage server to access the set of data, the plurality of storage protocols including a block-level storage protocol and a file-level storage protocol.

18. A method of operating a policy engine, the method comprising:

receiving at the policy engine, from a storage server, a first request and information relating to a set of data, the first request being in response to a storage-related client request received by the storage server from a client and relating to the set of data;

applying a defined policy in the policy engine using the information relating to a set of data; and

sending a first response from the policy engine to the storage server to indicate a result of applying the defined policy, the first response to cause the storage server to send a second response to the client in accordance with the first response.

19. A method as recited in claim 18, wherein the policy engine is external to the storage server.

20. A method as recited in claim 18, wherein the storage server and at least a portion of the policy engine are implemented in a single physical platform.

21. A method as recited in claim 18, wherein the client request is a request for a file managed by the storage server.

22. A method as recited in claim 18, wherein the client request is a request to create a file.

23. A method as recited in claim 22, wherein applying the defined policy comprises approving or denying the request to create the file based on a file type of the file.

24. A method as recited in claim 23, wherein the file type of the file is indicated in the information relating to the set of data.

25. A method as recited in claim 18, further comprising using the policy engine to define a criterion in the storage server, for use by the storage server to determine when a subsequent client request is to be referred to the policy engine for resolution.

26. A method as recited in claim 18, wherein applying the defined policy comprises approving or denying the second request based on an identity of the client.

27. A method as recited in claim 18, wherein applying the defined policy comprises approving or denying the second request based on an identity of a user of the client.

28. A method as recited in claim 18, wherein applying the defined policy comprises approving or denying the second request based on an identity of the storage server.

29. A method as recited in claim 18, wherein applying the defined policy comprises approving or denying the second request based on a user-based quota.

30. A method as recited in claim 18, wherein applying the defined policy comprises approving or denying the second request based on a quota applicable to the set of data.

31. A method as recited in claim 18, wherein applying the defined policy comprises approving or denying the second request based on a quota applicable to the storage server.

32. A method as recited in claim 18, wherein applying the defined policy comprises approving or denying the second request based on a number of times the set of data has been accessed during a period of time.

33. A method as recited in claim 18, further comprising the policy engine responding to the second request by retrieving the set of data from remote storage and providing the set of data to the storage server in conjunction with the first response.

35. A storage system as recited in claim 30, wherein the first request is a request for a file managed by the storage server.

36. A storage system as recited in claim 30, wherein the first request is a request to create a file.

37. A storage system as recited in claim 32, wherein the remote policy engine approves or denies the request to create the file based on a file type of the file.

38. A storage system as recited in claim 33, wherein the file type of the file is indicated in the information relating to the set of data.

34. A storage system comprising:

a storage server to provide a client with access via a network to data in a mass storage facility, the storage server configured to receive from the client a first request to perform a storage-related operation relating to a set of data managed or to be managed by the storage server, and to generate a second request if the first request satisfies a defined criterion; and

a remote policy engine coupled to the storage server to receive the second request and information relating to the set of data from the storage server, the remote policy engine configured to approve or deny the second request by implementing a defined policy using the information relating to the set of data, to send a first response to the storage server based on a result of implementing the defined policy, the storage server further configured to send a second response to the client in accordance with the first response.

39. A storage system as recited in claim 34, wherein the remote policy engine determines whether to approve or deny the second request based on the client.

40. A storage system as recited in claim 34, wherein the remote policy engine determines whether to approve or deny the second request based on a user-based quota.

41. A storage system as recited in claim 34, wherein the remote policy engine determines whether to approve or deny the second request based on a quota applicable to the set of data.

42. A storage system as recited in claim 34, wherein the information relating to the set of data comprises information specifically identifying the storage server from among a plurality of storage servers that are coupled to the remote policy engine.

43. A storage system as recited in claim 34, wherein the remote policy engine determines whether to approve or deny the second request based on a number of times the set of data has been accessed during a period of time.

44. A storage system as recited in claim 34, wherein the storage server does not send the client any response to the first request until the storage server receives the first response from the remote policy engine.

45. A storage system as recited in claim 34, wherein:

the storage server responds to the first request by using metadata in the storage server to determine that the set of data is stored externally to, and remotely from, the storage server; and

wherein the remote policy engine responds to the second request by retrieving the set of data from remote storage and provides the set of data to the storage server in conjunction with the first response.

46. A storage system as recited in claim 34, wherein the storage server is operable to implement each of a plurality of storage protocols to access data, the plurality of storage protocols including a block-level storage protocol and a file-level storage protocol.

47. A storage system comprising:

a plurality of storage servers, each to provide a set of clients with access to corresponding stored data; and

a policy engine to receive requests from each of the storage servers, each request being based on a previous storage-related request received by one of the storage servers from a client, the policy engine configured to respond to each request by implementing one or more of a set of defined storage-related policies and to send a response to a requesting storage server based on a result of implementing the defined policy, wherein one or more of the policies are specific to a particular storage server, and wherein the storage servers respond to the storage-related requests from clients in a manner synchronous with the responses from the policy engine.

48. A method of operating a storage server, the method comprising:

receiving at the storage server, from a client, a request to perform a storage-related operation relating to a set of data;

if the first request satisfies a defined criterion, then operating the storage server to invoke a policy engine configured to determine a disposition of the request;

receiving at the storage server a response from the policy engine indicating a disposition of the request; and

responding to the request in accordance with the response from the policy engine.

49. A method as recited in claim 48, wherein the policy engine is external to the storage server.