Method and apparatus for encapsulating a virtual filer on a filer

• US 7,269,696 B2
• Filed: 04/09/2003
• Issued: 09/11/2007
• Est. Priority Date: 12/28/2001
• Status: Expired due to Term

• Current Assignee: NetApp, Inc.
• Original Assignee: Network Appliance Incorporated (NetApp, Inc.)
• Inventors: Banga, Gaurav, Muhlestein, Mark
• Primary Examiner(s): NGUYEN, THAN VINH
• Application Number:
  US10/410,064
• Publication Number:
  US 20030195942A1
• Time in Patent Office: 1,616 Days
• Field of Search: 709212-219, 711/114, 711/147, 711/148
• US Class Current: 711/147
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

An architecture provides the ability to create and maintain multiple instances of virtual servers, such as virtual filers (vfilers), within a server, such as a filer. A vfiler is a logical partitioning of network and storage resources of the filer platform to establish an instance of a multi-protocol server. Each vfiler is allocated a subset of dedicated units of storage resources, such as volumes or logical sub-volumes (qtrees), and one or more network address resources. Each vfiler is also allowed shared access to a file system resource of a storage operating system. To ensure controlled access to the allocated and shared resources, each vfiler is further assigned its own security domain for each access protocol. A vfiler boundary check is performed by the file system to verify that a current vfiler is allowed to access certain storage resources for a requested file stored on the filer platform.

Claims

1. A method for encapsulating a virtual server on a server, comprising:

creating an instance of the virtual server executing on the server;

storing external and internal configuration information describing the virtual server instance on storage media of the server, wherein the storage media comprises one or more disks coupled to the server, the external configuration information describing resources assigned to the virtual server and capabilities available to the virtual server, the internal configuration information controlling operation of one or more protocol modules associated with the virtual server;

storing the external configuration information in a global registry on a volume of the server; and

storing the internal configuration information in a private registry on one of a volume or qtree assigned to the virtual server.

2. The method of claim 1 wherein the step of creating comprises logically partitioning the resources of the server to establish the instance of the virtual server.

3. The method of claim 1 wherein the external configuration information describing resources assigned to the virtual server comprises one or more network resources and one or more storage resources.

4. The method of claim 3 wherein the one or more network resources comprise one or more network addresses of a network interface assigned to the virtual server.

5. The method of claim 3 wherein the one or more storage resources comprise one or more volumes or qtrees on a volume.

6. The method of claim 1 wherein the external configuration information describing capabilities available to the virtual server comprises protocols configured to execute on the virtual server.

7. Apparatus configured to encapsulate a virtual filer (vfiler) on a filer, the apparatus comprising:

a processing element of the filer;

a memory coupled to the processing element; and

a vfiler context structure stored in the memory and accessible by the processing element, the vfiler context structure having a plurality of fields adapted to hold external and internal configuration information describing the vfiler, the external configuration information describing resources assigned to the vfiler and capabilities available to the vfiler, the internal configuration information controlling operation of one or more protocol modules associated with the vfiler, said plurality of fields of said vfiler context structure including at least one of the following;

a field that holds a name of the vfiler;

a field that holds a universally unique identifier (UUID) associated with the vfiler;

a field that holds a list of vfilers on the filer;

a field that holds a network space indicator that binds a network interface to a network address space in which the vfiler participates;

or

a field that holds a first reference to information pertaining to a security domain of the vfiler to thereby enables controlled access to allocated and shared resources of the vfiler, wherein the first reference comprises a pointer to a file containing one or more identifiers associated with a password used to authenticate a user accessing the vfiler.

8. The apparatus of claim 7 wherein the fields of the vfiler context structure further comprises a field that holds a second reference to information pertaining to a multi-protocol mapping procedure used to determine whether a client can access a requested resource of the vfiler.

9. The apparatus of claim 8 wherein the mapping procedure involves use of a security controller associated with a security style of the requested resource to perform lookup operations into a security database to resolve an identity of the client.

10. The apparatus of claim 8 wherein the second reference comprises a pointer that references a file that enables translation of permission checking attributes from one protocol to another.

11. Apparatus configured to encapsulate a virtual filer (vfiler) on a filer, the apparatus comprising:

a processing element of the filer;

a memory coupled to the processing element; and

a vfiler context structure stored in the memory and accessible by the processing element, the vfiler context structure having a plurality of fields adapted to hold external and internal configuration information describing the vfiler, the external configuration information describing resources assigned to the vfiler and capabilities available to the vfiler, the internal configuration information controlling operation of one or more protocol modules associated with the vfiler, said plurality of fields of said vfiler context structure including at least one of the following;

a field that holds a name of the vfiler;

a field that holds a universally unique identifier (UUID) associated with the vfiler;

a field that holds a list of vfilers on the filer;

a field that holds a network space indicator that binds a network interface to a network address space in which the vfiler participates;

a field that holds a first reference to information pertaining to a security domain of the vfiler to thereby enables controlled access to allocated and shared resources of the vfiler;

a field that holds a second reference to information pertaining to a multi-protocol mapping procedure used to determine whether a client can access a requested resource of the vfiler;

or

fields for holding a plurality of module data structures that includes information needed for an instance of one of a protocol and subsystem.

12. The apparatus of claim 11 wherein the information needed for an instance of a protocol includes information about contacting a domain controller, active sessions for the protocol and various control blocks associated with the protocol.

13. The apparatus of claim 12 wherein the domain controller is a network server that accepts logon requests and initiates authentication of the requests.

14. The apparatus of claim 13 wherein the information needed for an instance of a protocol further comprises information pertaining to a security domain, including one of a security identifier and a trust relationship with the domain controller.

15. A method for encapsulating a virtual server on a server, comprising:

creating an instance of the virtual server executing on the server; and

storing external and internal configuration information describing the virtual server instance on storage media of the server, the external configuration information describing resources assigned to the virtual server and capabilities available to the virtual server, the internal configuration information controlling operation of one or more protocol modules associated with the virtual server, wherein the external configuration information is stored in a first registry of the server, and the internal configuration information is stored in a second registry on a volume assigned to the virtual server.

16. The method of claim 15, wherein the step of creating comprises the step of logically partitioning the resources of the server to establish the instance of the virtual server.

17. The method of claim 15, wherein the storage media comprises one or more disks coupled to the server.

18. The method of claim 15, wherein the external configuration information describing resources assigned to the virtual server comprises one or more network resources and one or more storage resources.

19. The method of claim 18, wherein the one or more network resources comprise one or more network addresses of a network interface assigned to the virtual server.

20. The method of claim 18, wherein the one or more storage resources comprise one or more volumes or qtrees on a volume.

21. The method of claim 15, wherein the external configuration information describing capabilities available to the virtual server comprises protocols configured to execute on the virtual server.

22. A system to encapsulate a virtual server on a server, comprising:

the virtual server, configured by a processor as an instance executing on the server, wherein the virtual server is configured with an external and internal configuration information describing the virtual server on storage media of the server, the external configuration information describing resources assigned to the virtual server and capabilities available to the virtual server, the internal configuration information controlling operation of one or more protocol modules associated with the virtual server, wherein the external configuration information is stored in a of first registry the server, and the internal configuration information is stored in a second registry on a volume assigned to the virtual server.

23. The system of claim 22, further comprising a vserver context structure in a memory, the vserver context structure having a plurality of fields configured to hold external and internal configuration information describing the vserver.

24. The system of claim 23, wherein the external configuration information and internal configuration information fields of the vfiler context structure comprise a field that holds a name of the vfiler and a field that holds a universally unique identifier (UUID) associated with the vfiler.

25. The system of claim 24, wherein the UUID comprises a current time of day and a medium access control address associated with the vfiler.

26. The system of claim 24, wherein the fields of the vfiler context structure further comprise a field that holds a list of vfilers on the filer and a field that holds a network space indicator that binds a network interface to a network address space in which the vfiler participates.

27. The system of claim 26, wherein the fields of the vfiler context structure further comprises a field that holds a first reference to information pertaining to a security domain of the vfiler to thereby enable controlled access to allocated and shared resources of the vfiler.

28. The system of claim 27, wherein the first reference comprises a pointer to a file containing one or more identifiers associated with a password used to authenticate a user accessing the vfiler.

29. The system of claim 28 wherein the fields of the vfiler context structure further comprises a field that holds a second reference to information pertaining to a multi-protocol mapping procedure used to determine whether a client can access a requested resource of the vfiler.

30. The system of claim 28, wherein the mapping procedure involves use of a security controller associated with a security style of the requested resource to perform lookup operations into a security database to resolve an identity of the client.

31. The system of claim 28 wherein the second reference comprises a pointer that references a file that enables translation of permission checking attributes from one protocol to another.

32. The system of claim 28 wherein the fields of the vfiler context structure further comprise fields for holding a plurality of module data structures that includes information needed for an instance of one of a protocol and subsystem.

33. The system of claim 32, wherein the information needed for an instance of a protocol includes information about contacting a domain controller, active sessions for the protocol and various control blocks associated with the protocol.

34. The system of claim 33, wherein the domain controller is a network server that accepts logon requests and initiates authentication of the requests.

35. The system of claim 34, wherein the information needed for an instance of a protocol further comprises information pertaining to a security domain, including one of a security identifier and a trust relationship with the domain controller.