Controlling access to storage resources by using access pattern based quotas

• US 7,783,666 B1
• Filed: 09/26/2007
• Issued: 08/24/2010
• Est. Priority Date: 09/26/2007
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Mu, Paul Yuedong, Zhuge, John
• Primary Examiner(s): Le; Uyen T.
• Application Number:
  US11/862,140
• Time in Patent Office: 1,063 Days
• Field of Search: None
• US Class Current: 707/783
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185

Abstract

An apparatus and a method that limits a user'"'"'s access to data of the storage system based on an access quota. The method may include determining an access pattern of data access requests to storage resources by a user, and comparing the access pattern of the user against an access quota, as defined by an access policy. Based on the comparison, if the user'"'"'s access to the storage resources has exceeded the access quota, the storage system can limit access to the user to the storage resources.

Claims

1. A method performed by a storage system, comprising:

determining an access pattern of data access requests by a user to storage resources of a storage system;

comparing the access pattern of the user against an access quota without determining an amount of storage resources allowed to be used by the user; and

limiting access by the user to storage resources of the storage system when the access quota has been exceeded, wherein limiting access to the storage resources includes throttling access by the user to a storage resource by using a system-provided queue to delay access to the storage resource by the user.

2. The method of claim 1, wherein delaying access comprises temporarily lowering an access priority of the user.

3. The method of claim 1, wherein the access quota comprises access attributes for each user, and wherein the access attributes comprise at least one of a group, a type of group, a level of security access, a number of data access requests allowed for a particular user, a time period, a number of operations allowed for a particular user, a number of data requests to a particular directory of a logical data container, a number or users that have accessed the logical data container, a number of clients that have accessed the logical data container, or an access priority of a particular user.

4. The method of claim 1, wherein determining the access pattern comprises determining a number of data access requests by the user during a time period, wherein determining the number of data access requests comprises performing a lookup operation in a first data store that stores the number of data access requests by the user during a defined time period, wherein comparing comprises performing a lookup operation in a second data store that stores the access quota, and wherein the access quota comprises a limit on a number of data access requests by the user during a time period.

5. The method of claim 1, wherein determining the access pattern comprises:

monitoring data access requests for the user on the storage system to check for a quota-sensitive data access request; and

determining the access pattern by the user during a time period based on the monitoring, wherein the quota-sensitive data access request comprise at least one of;

creating a new file, reading an existing file, deleting an existing file, or writing to an existing file to append the data of the existing file.

6. The method of claim 1, wherein the access quota comprises a limit on access to a storage area that is designated as having sensitive data based on an access priority of the user.

7. The method of claim 1, wherein the access quota comprises a soft-quota definition, wherein executing the system rule comprises generating a warning indicating that the user has exceeded the access quota, wherein the access quota further comprises a hard-quota definition, and wherein executing the system rule comprises preventing fulfillment of a quota-sensitive data access request that would exceed the access quota.

8. A storage server, comprising:

a processor comprising an access quota manager and an access quota enabler;

a first communication interface through which to communicate with a plurality of storage devices;

a second communication interface through which to communicate with a client of the storage server; and

a memory storing instructions which configure the processor to receive data access requests from the client at the access quota manager, to monitor the data access requests for quota-sensitive data access requests, to determine an access pattern by the user during a time period using the access quota manager, to compare the access pattern by the user against an access quota policy stored in an access policy data store coupled to the access quota manager without determining an amount of storage resources allowed to be used by the user, and to limit access to data on the plurality of storage devices using an access quota enabler when the access pattern violates the access quota policy, wherein limiting access to the data includes throttling access by the user to a storage resource by using a system-provided queue to delay access to the storage resource by the user.

9. The storage server of claim 8, wherein the access quota manager is configured to determine the access pattern by determining an amount of data access requests by the user during a time period, and comparing the amount data access requests against the access quota, which indicates a number of data access requests allowed for the user during the time period, to determine if the access pattern violates the access quota policy.

10. The storage server of claim 8, wherein the access quota manager is implemented as at least one of an access quota protocol filter or an access quota file system filter.

11. The storage server of claim 8, wherein the access quota manager is embedded in a protocol layer of an operating system of the processor or in a file system layer of an operating system of the processor.

12. The storage server of claim 8, wherein the access quota policy defines a type of access quota action to be performed by the access quota enabler for different types of access patterns by the user, and wherein the access quota enabler triggers access quota actions when the access pattern violates the access quota policy.

13. The storage server of claim 12, wherein the access quota policy is violated when the user performs a directory listing within a predetermined amount of time, and wherein the access quota action comprises preventing the user from performing a directory listing with a defined period of time after violating the access quota policy.

14. The storage server of claim 8, wherein the access quota policy comprises at least one of the following policy parameters:

number of data access requests, a time period, type of data access request, type of user, type of client, type of work load, or type of application, and wherein the access quota policy is a Boolean expression of the policy parameters.

15. A method performed by a storage system, comprising:

monitoring quota-sensitive data access requests received from a client requesting services of the storage system;

identifying a number of quota-sensitive data access requests to a logical data container by a user during a time period;

comparing the number of quota-sensitive data access requests by the user against an access quota, which indicates a number of quota-sensitive data access requests allowed for the user during the time period, without determining an amount of storage resources allowed to be used by the user; and

limiting access to data stored in the logical data container when the number of quota-sensitive data access requests by the user received over the time interval violates the access quota, wherein limiting access to the data includes throttling access by the user to the data by using a system-provided queue to delay access to the data by the user.

16. The method of claim 15, wherein determining the number of quota-sensitive data access requests comprises performing a lookup operation in a first data store that stores the number of quota-sensitive data access requests by the user during the time period, and wherein said comparing comprises performing a lookup operation in a second data store that stores the access quota for the user.

17. A storage server, comprising:

a processor;

a first communication interface coupled to the processor, through which to communicate with a plurality of storage devices;

a second communication interface coupled to the processor, through which to communicate with a client of the storage server; and

a memory storing instructions which configure the processor to receive data access requests from the client, to monitor the data access requests for quota-sensitive data access requests, to determine a number of quota-sensitive data access requests to a logical data container by the user during a time period, to compare the number of quota-sensitive data access requests by the user against an access quota, which indicates a number of data access requests allowed for the user during the defined time period, stored in an access policy data store, and to limit access to data on the plurality of storage devices when the access pattern violates the access quota policy, wherein limiting access to the data includes throttling access by the user to the data by using a system-provided queue to delay access to the data by the user.