Enabling proxy services using referral mechanisms

• US 20050125503A1
• Filed: 09/15/2004
• Published: 06/09/2005
• Est. Priority Date: 09/15/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Systems, Inc.
• Inventors: Wong, Thomas K., Chawla, Rajeev, Simpkins, Richard A., Tsirigotis, Panagiotis, Liu, Zuwei, Seitz, Matthew, Iyengar, Anand
• Granted Patent: US 8,539,081 B2
• Time in Patent Office: Days
• US Class Current: 709/213
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561

Abstract

A NAS (Network Attaches Storage) switch authenticates a client on multiple file servers for proxy services. The NAS switch enables proxy services by successively authenticating the client on the file servers using referrals. The NAS switch further comprises a connection manager to establish connections to the client and the file servers, a referral manager to redirect the client for successive authentications, and a transaction manager to perform data transfers with the file servers on behalf of the client. The system components support DFS (Distributed File System), and communicate using a protocol dialect that supports referral mechanisms such as NFSv4 (Network File Server version 4) or CIFS (Common Internet File System). The transaction manager also performs a protocol dialect translation service when the connection manager negotiates one protocol dialect with the client, and a different protocol dialect with the file server.

Claims

1. A method for authenticating a client supporting referrals with a plurality of file servers to provide proxy services for the client, comprising the steps of:

establishing a connection with the client;

authenticating the client with the plurality of file servers by successively redirecting the client to provide authentication information to each of the plurality of file servers with a plurality of referrals; and

performing transactions with the plurality of file servers on behalf of the client.

2. The method of claim 1, wherein establishing the connection with the client comprises:

negotiating a first protocol dialect with the client.

3. The method of claim 2, further comprising:

negotiating a second protocol dialect with at least one file server from the plurality of file servers, the second protocol dialect differing from the first protocol dialect,

wherein the performing transactions comprises translating a transaction request from the first protocol dialect to the second protocol dialect.

4. The method of claim 2, further comprising:

negotiating a third protocol dialect with at least one file server from the plurality of file servers, the third protocol dialect differing from the second protocol dialect.

5. The method of claim 2, wherein the first protocol dialect comprises one from the group consisting of:

NFS (Network File System) and CIFS (Common Internet File System)

6. The method of claim 1, wherein the authenticating the client with the plurality of file servers comprises:

receiving a transaction request from the client; and

sending an error message to the client responsive to the transaction request.

7. The method of claim 1, wherein the authenticating the client with the plurality of file servers comprises:

receiving a referral request from the client; and

referring the client to a file server from the plurality of file servers.

8. The method of claim 1, wherein the authenticating the client with the plurality of file servers comprises:

receiving authentication information for at least one file server; and

establishing a connection to the at least one file server using the authentication information.

9. The method of claim 8, wherein the authenticating information comprises Kerberos authentication information.

10. The method of claim 1, wherein the authenticating the client with the plurality of file servers comprises:

negotiating a third protocol dialect with a second file server.

11. The method of claim 1, wherein the authenticating the client with the plurality of file servers comprises:

associating the plurality of file servers with the virtual server; and

referring the client with to virtual server using a sharename that uniquely identifies the client.

12. The method of claim 1, wherein the authenticating the client with the plurality of file servers comprises:

authenticating the client with the plurality of file servers using a plurality of proxy servers, each at a separate network address.

13. The method of claim 12, further comprising:

associating the plurality of file servers with a virtual server at a network address differing from the proxy server network addresses.

14. The method of claim 1, wherein the client supports DFS (Distributed File System).

15. The method of claim 1, wherein the performing the transactions comprises:

performing transactions from the group consisting of;

create file, delete file, move file, copy file, read file, and write file.

16. A method for authenticating a NAS client supporting referrals with a plurality of NAS file servers to provide proxy services for the NAS client, comprising the steps of:

establishing a connection with the NAS client that supports DFS (Distributed File System);

receiving a transaction request from the NAS client; and

sending an error message to the NAS client responsive to the transaction request receiving a referral request from the NAS client; and

referring the NAS client to a NAS file server from the plurality of file servers receiving authentication information for the NAS file server; and

establishing a connection to the NAS file server using the authentication information; and

performing transactions with the plurality of NAS file servers on behalf of the NAS client.

17. A NAS (Network Attached Storage) switch to authenticate a client supporting referrals with a plurality of file servers to provide proxy services for the client, comprising:

a connection manager to establish a connection with the client;

a referral manager to authenticate the client with the plurality of file servers by successively redirecting the client to provide authentication information to each of the plurality of file servers with a plurality of referrals; and

a transaction manager to perform transactions with the plurality of file servers on behalf of the client.

18. The NAS switch of claim 17, wherein the connection manager negotiates a first protocol dialect with the client.

19. The NAS switch of claim 18, wherein the connection manager negotiates a second protocol dialect with at least one file server from the plurality of file servers, the second protocol dialect differing from the first protocol dialect, and the transaction manager translates a transaction request from the first protocol dialect to the second protocol dialect.

20. The NAS switch of claim 18, wherein the connection manager negotiates a third protocol dialect with at least one file server from the plurality of file servers, the third protocol dialect differing from the second protocol dialect.

21. The NAS switch of claim 18, wherein the first protocol dialect comprises one from the group consisting of:

NFS (Network File System) and CIFS (Common Internet File System).

22. The NAS switch of claim 17, wherein the referral manager receives a transaction request from the client and, in response, sends an error message to the client.

23. The NAS switch of claim 17, wherein the referral manager receives a referral request from the client and, in response refers the client to a file server from the plurality of file servers.

24. The NAS switch of claim 17, wherein the referral manager receives authentication information for at least one file server, and establishes a connection to the at least one file server using the authentication information.

25. The NAS switch of claim 24, wherein the authenticating information comprises Kerberos authentication information.

26. The NAS switch of claim 17, wherein the referral manager negotiates a third protocol dialect with a second file server.

27. The NAS switch of claim 17, wherein the referral manager associates the plurality of file servers with the virtual server, and refers the client with the virtual server using a sharename that uniquely identifies the client.

28. The NAS switch of claim 17, wherein the authenticating the client with the plurality of file servers comprises:

authenticating the client with the plurality of file servers using a plurality of proxy servers, each at a separate network address.

29. The NAS switch of claim 28, further comprising:

associating the plurality of file servers with a virtual server at a network address differing from the proxy server network addresses.

30. The NAS switch of claim 17, wherein the client supports DFS (Distributed File System).

31. The NAS switch of claim 17, wherein the performing the transactions comprises:

performing transactions from the group consisting of;

create file, delete file, move file, copy file, read file, and write file.

32. A computer program product, comprising a computer-readable medium having computer program instructions for a method for authenticating a client supporting referrals with a plurality of file servers to provide proxy services for the client, the method comprising the steps of:

establishing a connection with the client;

authenticating the client with the plurality of file servers by successively redirecting the client to provide authentication information to each of the plurality of file servers with a plurality of referrals; and

performing transactions with the plurality of file servers on behalf of the client.

33. The computer program product of claim 32, wherein establishing the connection with the client comprises:

negotiating a first protocol dialect with the client.

34. The computer program product of claim 33, further comprising:

negotiating a second protocol dialect with at least one file server from the plurality of file servers, the second protocol dialect differing from the first protocol dialect,

wherein the performing transactions comprises translating a transaction request from the first protocol dialect to the second protocol dialect.

35. The computer program product of claim 33, further comprising:

negotiating a third protocol dialect with at least one file server from the plurality of file servers, the third protocol dialect differing from the second protocol dialect.

36. The computer program product of claim 33, wherein the first protocol dialect comprises one from the group consisting of:

NFS (Network File System) and CIFS (Common Internet File System)

37. The computer program product of claim 32, wherein the authenticating the client with the plurality of file servers comprises:

receiving a transaction request from the client; and

sending an error message to the client responsive to the transaction request.

38. The computer program product of claim 32, wherein the authenticating the client with the plurality of file servers comprises:

receiving a referral request from the client; and

referring the client to a file server from the plurality of file servers.

39. The computer program product of claim 32, wherein the authenticating the client with the plurality of file servers comprises:

receiving authentication information for at least one file server; and

establishing a connection to the at least one file server using the authentication information.

40. The computer program product of claim 39, wherein the authenticating information comprises Kerberos authentication information.

41. The computer program product of claim 32, wherein the authenticating the client with the plurality of file servers comprises:

negotiating a third protocol dialect with a second file server.

42. The computer program product of claim 32, wherein the authenticating the client with the plurality of file servers comprises:

associating the plurality of file servers with the virtual server; and

referring the client with to virtual server using a sharename that uniquely identifies the client.

43. The computer program product of claim 32, wherein the authenticating the client with the plurality of file servers comprises:

authenticating the client with the plurality of file servers using a plurality of proxy servers, each at a separate network address.

44. The computer program product of claim 43, further comprising:

associating the plurality of file servers with a virtual server at a network address differing from the proxy server network addresses.

45. The computer program product of claim 32, wherein the client supports DFS (Distributed File System).

46. The computer program product of claim 32, wherein the performing the transactions comprises:

performing transactions from the group consisting of;

create file, delete file, move file, copy file, read file, and write file.

47. A NAS (Network Attached Storage) switch to authenticate a client supporting referrals with a plurality of file servers to provide proxy services for the client, comprising:

a means for establishing a connection with the client;

a means for authenticating the client with the plurality of file servers by successively redirecting the client to provide authentication information to each of the plurality of file servers with a plurality of referrals; and

a means for performing transactions with the plurality of file servers on behalf of the client.