METHOD AND APPARATUS TO KEEP CONSISTENCY OF ACLS AMONG A META DATA SERVER AND DATA SERVERS

• US 20130291066A1
• Filed: 04/25/2012
• Published: 10/31/2013
• Est. Priority Date: 04/25/2012
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: OKITA, Hideki, NAKANO, Takahiro
• Granted Patent: US 9,064,106 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Exemplary embodiments may involve a meta-data server that manages data-server access control list (DS ACL) information. Each entry of this DS ACL information may include an address of a data server, an identification or a range address of chunk data on the data server, a file path of the chunk data in the file tree provided by the meta-data server, and addresses of the permitted clients. The meta-data server may determine the addresses of the permitted clients for the chunk data by retrieving the original file path of chunk data from layout information of the meta-data server, and by retrieving the entry containing the directory path that partially matches with the original file path from an access control list of the meta-data server.

Claims

1. A meta data server coupled to a plurality of client computers and a plurality of data servers, comprising:

a memory configured to store an indication of a relationship between a group comprising a plurality of first identification information, and a second identification information associated with a client computer from the plurality of client computers, the client computer having permission to access a data related to the group, wherein each of the plurality of first identification information comprises data from a respective data server of the plurality of data servers, the data server of the each of the plurality of first identification information being different from other ones of the plurality of data servers associated with respective other ones of the plurality of first identification information; and

a controller operable to manage the relationship and to control access from the client computer to the data server based on the relationship in the memory.

2. The meta data server of claim 1, wherein the first information further comprises file path information and file name information of the data;

wherein the second identification information comprises at least one Internet Protocol (IP) address segment; and

wherein the controller controls the access from the client computer based on the relationship in the memory and an address segment of the client computer.

3. The meta data server of claim 1, wherein the first information comprises file path information and block information of the data;

wherein the second identification information comprises at least one internet small computer system interface qualified name (IQN); and

wherein the controller controls the access from the client computer based on the relationship in the memory and the IQN of the client computer.

4. The meta data server of claim 1, wherein the first information comprises file path information and block information of the data;

wherein the second identification information comprises at least one Fibre Channel (FC) World Wide Name (WWN); and

wherein the controller controls the access from the client computer based on the relationship in the memory and the FC-WWN of the client computer.

5. The meta data server of claim 1, wherein the memory further stores an open processing program operable to configure the plurality of data servers to control access from the plurality of client computers based on the second identification information when executed in a first mode, and further operable to generate a response comprising a file handle.

6. The meta data server of claim 5, wherein the memory further stores a layout processing program operable to configure the plurality of data servers to control access from the plurality of client computers based on the second identification information when executed in a second mode, and further operable to generate a response comprising layout information.

7. The meta data server of claim 6, wherein the controller is further configured to change a mode of the meta data server from the second mode to the first mode, or from the first mode to the second mode.

8. The meta data server of claim 1, wherein the controller in response to a request to create a file, is configured to update the first identification information based on the file and update the second identification information based on the request.

9. The meta data server of claim 1, wherein the meta data server is integrated into a parallel Network File System (pNFS).

10. A system, comprising:

a plurality of client computers;

a plurality of data servers; and

a meta data server coupled to the plurality of client computers and the plurality of data servers, comprising;

a memory configured to store an indication of a relationship between a group comprising a plurality of first identification information, and a second identification information associated with a client computer from the plurality of client computers, the client computer having permission to access a data related to the group, wherein each of the plurality of first identification information comprises data from a respective data server of the plurality of data servers, the data server of the each of the plurality of first identification information being different from respective other ones of the plurality of data servers associated with other ones of the plurality of first identification information; and

a controller operable to manage the relationship and to control access from the client computer to the data server based on the relationship in the memory. wherein each of the plurality of first identification information comprises data of a data server from the plurality of data servers, the data server being different from the data server of other ones of the plurality of first identification information.

11. The system of claim 10, wherein the first information further comprises file path information and file name information of the data;

wherein the second identification information comprises at least one Internet Protocol (IP) address segment; and

wherein the controller controls the access from the client computer based on the relationship in the memory and the IP address segment of the client computer.

12. The system of claim 10, wherein the first information comprises file path information and block information of the data;

wherein the second identification information comprises at least one internet small computer system interface qualified name (IQN); and

wherein the controller controls the access from the client computer based on the relationship in the memory and the IQN of the client computer.

13. The system of claim 10, wherein the first information comprises file path information and block information of the data;

wherein the second identification information comprises at least one Fibre Channel (FC) World Wide Name (WWN); and

wherein the controller controls the access from the client computer based on the relationship in the memory and the FC-WWN of the client computer.

14. The system of claim 10, wherein the memory further stores an open processing program operable to configure the plurality of data servers to control access from the plurality of client computers based on the second identification information when executed in a first mode, and further operable to generate a response comprising a file handle.

15. The system of claim 14, wherein the memory further stores a layout processing program operable to configure the plurality of data servers to control access from the plurality of client computers based on the second identification information when executed in a second mode, and further operable to generate a response comprising layout information.

17. The system of claim 10, wherein the controller in response to a request from one of the plurality of clients to create a file, is configured to update the first identification information based on the file and update the second identification information based on the request.

18. The system of claim 10, wherein the system is a parallel Network File System (pNFS).

16. The system of claim 16, wherein the controller is further configured to change a mode of the meta data server from the second mode to the first mode, or from the first mode to the second mode.

19. A non-transitory computer readable medium storing instructions for operating a meta data server, the instructions comprising:

managing an indication of a relationship between a group comprising a plurality of first identification information, and a second identification information associated with a client computer from the plurality of client computers, the client computer having permission to access a data related to the group, wherein each of the plurality of first identification information comprises data from a respective data server of the plurality of data servers, the data server of the each of the plurality of first identification information being different from other ones of the plurality of data servers associated with respective other ones of the plurality of first identification information; and

controlling access from the client computer to the data server based on the relationship in the memory.

20. The non-transitory computer readable medium of claim 19, wherein the first information further comprises file path information and file name information of the data;

wherein the second identification information comprises at least one Internet Protocol (IP) address segment; and

wherein the controlling the access from the client computer is based on the relationship in the memory and an address segment of the client computer.