COMPUTER SYSTEM AND STORAGE CAPACITY EXTENSION METHOD

• US 20120102080A1
• Filed: 05/20/2010
• Published: 04/26/2012
• Est. Priority Date: 05/20/2010
• Status: Abandoned Application

• Current Assignee: Hitachi, Ltd., Hitachi Software Engineering Co., Ltd. (Hitachi, Ltd.)
• Original Assignee: Hitachi, Ltd., Hitachi Software Engineering Co., Ltd. (Hitachi, Ltd.)
• Inventors: Kirihata, Yasuhiro, Hay, Michael, Yamaguchi, Kota
• Application Number:
  US12/746,216
• Publication Number:
  US 20120102080A1
• Time in Patent Office: Days
• US Class Current: 707/831
• CPC Class Codes: G06F 16/1774 Locking methods, e.g. locking methods for file systems allowing shared and concurrent access to files
• CPC Class Codes: G06F 16/1827 Management specifically adapted to NAS management of storage area networks [SAN] G06F3/067
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Provided is a computer system configured so that security compliance problems can be avoided and an access control model which can be uniquely customized can be implemented by extending the storage capacity to an external storage service by means of integrated management of an existing NAS(s) and the external storage service, and controlling the optimum data placement according to the confidentiality and importance level of data.

In a computer system according to this invention, a local storage system includes an extended server for integrating a NAS(s) existing in the local storage system with an external storage service and thereby providing a client with a storage area as a single virtual NAS.

Claims

1. A computer system with a local storage system and an external storage service connected via a wide area network,

wherein the local storage system includes:

a user terminal;

an NAS for providing a storage area to the user terminal; and

an information processing unit for providing the user terminal with the storage area in the NAS by integrating the NAS and the external storage service and thereby configuring a single virtual NAS; and

wherein the information processing unit includes;

a first module for analyzing a file access request from the user terminal and obtaining a path to an access target file;

a second module for judging whether access to the access target file should be permitted or not;

a third module for configuring a single virtual directory and managing the path to the file based on the directory; and

a fourth module for migrating the file to the external storage service based on attribute information about the file.

2. The computer system according to claim 1, wherein the second module applies a unique access control function to the file access.

3. The computer system according to claim 1, wherein the fourth module determine a file attribute of the access target file accessed by the user terminal and migrate the file to the NAS or the external storage system according to the file attribute.

4. The computer system according to claim 2, said information processing unit further comprising:

a sixth module having attribute information for unique access control that is set to a requestor of the access request; and

a database having an attribute of the file; and

wherein the second module analyzes a protocol of the file access, obtains an account of the access requestor and file path information, inquires of the sixth module based on the obtained information, and then obtains a first attribute of the unique access control;

accesses the file attribute database and obtains a second attribute of the access control corresponding to the access target file; and

judges based on the first attribute and the second attribute whether access to the access target file should be permitted or not.

5. The computer system according to claim 4, wherein the second module judges whether a module for setting the unique access control is implemented in a user terminal of the access requestor or not;

and

If a negative judgment is returned, the file access request is rejected.

6. The computer system according to claim 1, wherein a plurality of local storage systems are connected to the wide area network,

a shared file shared by the plurality of local storage systems exists in at least one cache for the plurality of local storage systems or in the external storage service, and

the computer system further comprises a distributed lock server for managing a distributed lock for the shared file.

7. The computer system according to claim 6, wherein the distributed lock server has identification information about a local storage system which has executed a latest update to the shared file;

and

a local storage system which has received a file open request from the user terminal sends a lock acquisition request to the distributed lock server,

analyzes a response from the distributed lock server and obtains the identification information, and

obtains the shared file for the local storage system specified by the identification information and executes processing on the shared file.

8. The computer system according to claim 7, wherein the local storage system which has received the file open request from the user terminal determines that the response from the distributed lock server does not include the identification information, it obtains the shared file from the external storage service.

9. The computer system according to claim 7, wherein if the local storage system which has received the file open request from the user terminal terminates the processing on the shared file, it issues an unlock request and its own identification information to the distributed lock server.

10. The computer system according to claim 1, wherein a plurality of local storage systems are connected to the wide area network;

wherein when the external storage service stores a shared file which is shared by the plurality of local storage systems and is updated by one or more local storage systems from among the plurality of local storage systems, the external storage service stores both a pre-update shared file and a post-update shared file;

wherein a file set is constituted from the pre-update shared file and the post-update shared file; and

wherein the computer system has a server for confirming on one or more files belonging to the file set as the shared file.

11. The computer system according to claim 10, wherein the server has a policy table in which a policy is registered;

determines a file on which a commit processing is executed according to the policy, from among a plurality of files constituting the file set, and deletes said shared file, on which the commit processing has not been executed, from the external storage service.

12. The computer system according to claim 11, wherein the server sends a notice to request approval of the commit processing to the plurality of local storage systems;

and if all the local storage systems approve the commit processing, the server executes the commit processing.

13. A data capacity extension method for a computer system with a local storage system and an external storage service connected via a wide area network,

wherein the local storage system includes:

a user terminal;

an NAS for providing a storage area to the user terminal; and

an information processing unit for providing the user terminal with the storage area in the NAS by integrating the NAS and the external storage service and thereby configuring a single virtual NAS; and

wherein the information processing unit executes;

a first step for analyzing a file access request from the user terminal and obtaining a path to an access target file;

a second step for judging whether access to the access target file should be permitted or not;

a third step for configuring a single virtual directory and managing the path to the file based on the directory; and

a fourth step for migrating the file to the external storage service based on attribute information about the file.