Running third party applications as embedded agents in a storage management server

• US 8,224,934 B1
• Filed: 03/09/2009
• Issued: 07/17/2012
• Est. Priority Date: 03/09/2009
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Dongre, Rommel, Cnudde, Isabelle F. D.
• Primary Examiner(s): Shaw, Peling
• Assistant Examiner(s): RICHARDSON, THOMAS W
• Application Number:
  US12/400,720
• Time in Patent Office: 1,226 Days
• Field of Search: 709/221, 726/21, 726/27, 713/189, 712/200, 712/227
• US Class Current: 709/221
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Running applications to support a storage server is made more efficient by at least establishing a sandbox to run the applications as embedded agents within the storage server. To accomplish this, in at least one embodiment, a management module of the storage server designates resources of the storage server to establish the sandbox using a role based access control mechanism. The sandbox communicates with the management module to access the resources of an operating system of the storage server to run the applications. Based on this, the need for separate external computers to run the applications is eliminated. Additionally, an administrator can control operations of the applications through the management module, thus providing the administrator a uniform interface for controlling both the storage server and the applications. The applications also utilize an existing user interface of the storage server to display logs and events to the administrator.

Claims

1. A storage management server comprising:

a set of one or more processors to execute operations of a management module, a network module and a data module, wherein;

the storage management server is a special-purpose processing system configured to store, manage, and retrieve data in a set of mass storage devices on behalf of one or more network storage clients, the network module is configured to enable the storage management server to communicate with the one or more network storage clients, and the data module is configured to manage data retrieval and storage in the set of mass storage devices;

the management module is configured to establish a sandbox to operate a third-party application as an embedded agent within the storage management server, wherein the management module is configured to establish the sandbox by implementing a plurality of enforcements to constrain operation of the third-party application within a controlled set of the storage management server'"'"'s resources, and wherein the management module is configured to implement the plurality of enforcements by establishing a specific role for the sandbox in a role based access control mechanism of the storage management server;

the sandbox uses the role based access control mechanism to enable the third-party application to communicate with the management module, wherein the third-party application is entirely enabled and operable from within the storage management server as a native service offered from within the storage management server independent of and without need for communication with any third-party server for operation of the third-party application, and wherein the third-party application is configured to provide a service related to the providing of data access services by the storage management server to the one or more network storage clients; and

the management module provides the third-party application restricted access to an operating system of the storage management server to enable operation of the third-party application as an embedded agent within the storage management server; and

a memory coupled to the one or more processors to store the operating system of the storage management server.

2. The storage management server of claim 1, wherein, each of the plurality of enforcements corresponds to a particular restriction placed to constrain the operation of the third-party application.

3. The storage management server of claim 2, wherein, the particular restriction includes one of:

a restriction on a quantity of data that the third-party application may store in a local storage of the storage management server;

a restriction on an amount of system memory that may be used by the third-party application;

a restriction on a number of processor cycles that may be used by the third-party application;

or

a restriction on a priority of a process thread corresponding to the third-party application.

4. The storage management server of claim 1, wherein, the specific role encompasses a plurality of access permissions assigned to the third-party application, each of the plurality of permission levels defining a particular enforcement of the plurality of enforcements.

5. The storage management server of claim 4, wherein, the role based access control mechanism utilizes the plurality of access permissions encompassed in the specific role to implement each of the plurality of enforcements to constrain the operation of the third-party application.

6. The storage management server of claim 1, wherein the sandbox enables an interface to be established between the storage management server and the third-party application without requiring an additional computer to be used to execute the third-party application.

7. The storage management server of claim 1, wherein the management module is configured to allow an administrator to control operation of the storage management server.

8. The storage management server of claim 1, wherein running the third-party application as an embedded agent within the storage management server enables an administrator to control operations of the application through the management module of the storage management server.

9. The storage management server of claim 8, wherein running the third-party application as an embedded agent within the storage management server enables the administrator to control the operations of the third-party application without requiring the administrator to access a different computer.

10. The storage management server of claim 1, wherein the management module enables the third-party application to access a database module of the storage management server, wherein the database module includes configuration information of a plurality of storage clients and a plurality of storage media connected to the storage management server.

11. The storage management server of claim 10, wherein the management module uses the role based access control mechanism to enable an administrator to control the third-party application'"'"'s access to the database module.

12. The storage management server of claim 1, wherein during operation, the management module monitors a first resource of the storage management server'"'"'s resources utilized by the third-party application.

13. The storage management server of claim 12, wherein the management module prevents the third-party application from utilizing more than a predetermined amount of the first resource.

14. The storage management server of claim 12, wherein the first resource includes at least one of a local storage, a processor, a system memory, or a local memory.

15. A method of operating a third-party application within a storage management server, the method comprising:

the storage management server including a network module, a data module, and a management module, the storage management server configured to store, manage, and retrieve data in a set of mass storage devices on behalf of one or more network storage clients, wherein the network module is configured to enable the storage management server to communicate with the one or more network storage clients, and the data module is configured to manage data retrieval and storage in the set of mass storage devices;

establishing a sandbox by the management module within the storage management server by implementing a plurality of enforcements to constrain operation of the third-party application within a controlled set of the storage management server'"'"'s resources, wherein the management module of the storage management server implements the plurality of enforcements by establishing a specific role for the sandbox in a role based access control mechanism of the storage management server;

operating the third-party application within the sandbox, wherein the sandbox uses the role based access control mechanism to enable the third-party application to communicate with the management module, wherein the third-party application is a entirely enabled and operable from within the storage management server as a native service offered from within the storage management server independent of and without need for communication with any third-party servers for operation of the third-party application, and wherein the third-party application is configured to provide a service related to the providing of data access services by the storage management server to the one or more network storage clients; and

providing, using the management module, restricted access to an operating system of the storage management server to operate the third-party application as an embedded agent within the storage management server.

16. The method of claim 15, wherein the executing the third-party application within the sandbox enables the third-party application to be run without requiring an additional computer.

17. The method of claim 15, wherein a user interface of the management module enables an administrator to control operation of the storage management server.

18. The method of claim 17, further comprising:

enabling an administrator to control operation of the third-party application through the management module of the storage management server, without requiring the administrator to access a different computer to access the application.

19. The method of claim 17, further comprising:

monitoring, using the management module, a plurality of resources utilized by the third-party application;

establishing, through the management module, a limit for each of the plurality of resources for the third-party application; and

preventing the third-party application from exceeding the limit for each of the plurality of resources.

20. The method of claim 19, wherein the plurality of resources include a local storage, a processor, a system memory, or a local memory.

21. The method of claim 15, further comprising:

providing, to the third-party application running within the sandbox, access to a database module of the storage management server; and

limiting access of the third-party application to the database module based on a specific condition.

22. The method of claim 21, further comprising:

providing an interface for the third-party application to retrieve information from the database module.

23. The method of claim 15, further comprising:

providing a logging capability to the third-party application, wherein the third-party application accesses a local storage of the storage management server to save log files generated using the logging capability.

24. The method of claim 15, further comprising:

handling events generated by the third-party application using the management module of the storage management server.

25. The method of claim 23, wherein an administrator receives events associated with the third-party application through a user interface of the storage management server.

26. A computer implemented method for protecting data in a storage management server, the method comprising:

the storage management server including a network module, a data module, and a management module, the storage management server configured to store, manage, and retrieve data in a set of mass storage devices on behalf of one or more network storage clients, wherein the network module is configured to enable the storage management server to communicate with the one or more network storage clients, and the data module is configured to manage data retrieval and storage in the set of mass storage devices;

establishing, using the management module of the storage management server, a sandbox to operate a plurality of third-party applications within the storage management server, wherein the management module establishes the sandbox by implementing a plurality of enforcements to constrain operation of the plurality of third-party applications within a controlled set of the storage management server'"'"'s resources;

operating the plurality of third-party applications as embedded agents in the sandbox, wherein the sandbox uses a role based access control mechanism of the storage management server to enable the plurality of third-party applications to communicate with the management module, wherein the third-party applications are entirely enabled and operable from within the storage management server as a native service offered from within the storage management server independent of and without need for communication with any third-party servers for operation of the third-party application, and wherein the third-party applications are configured to provide services related to the providing of data access services by the storage management server to the one or more network storage clients; and

providing, using the management module, restricted access to an operating system of the storage management server to operate each of the plurality of third-party applications as embedded agents within the storage management server.

27. The method of claim 26, wherein the management module implements the plurality of enforcements by establishing a specific role for the sandbox in the role based access control mechanism of the storage management server.

28. The method of claim 27, further comprising:

monitoring, using the management module, a plurality of resources utilized by a particular application of the plurality of third-party applications;

establishing, through the management module, a limit for each of the plurality of resources for the particular application; and

preventing the particular application from exceeding the limit for each of the plurality of resources.

29. The method of claim 28, wherein the plurality of resources include a local storage, a processor, a system memory, or a local memory.

30. The method of claim 27, further comprising:

establishing, using the management module, a priority of operation for each of the plurality of third-party applications; and

allocating the plurality of resources to each of the plurality of third-party applications based on the priority of operation.

31. The method of claim 27, further comprising:

determining, using the management module, whether the particular application is seeking to utilize more than a predetermined limit of a first resource from the plurality of resources;

identifying, using the management module, a remainder resource associated with the first resource; and

permitting the particular application to utilize the remainder resource.

32. The method of claim 26, wherein, each of the plurality of enforcements corresponds to a particular restriction placed to constrain the operation of the plurality of third-party applications.

33. The storage management server of claim 32, wherein, the particular restriction includes one of:

a restriction on a quantity of data that the plurality of third-party applications may share in a local storage of the storage management server;

a restriction on an amount of system memory that may be used by the plurality of third-party applications;

a restriction on a number of processor cycles that may be used by the plurality of third-party applications;

or

a restriction on a priority of a process thread corresponding to the plurality of third-party applications.

34. The method of claim 26, wherein, the management module implements the plurality of enforcements by establishing a specific role for the sandbox in the role based access control mechanism of the storage management server.

35. The method of claim 34, wherein, the specific role encompasses a plurality of access permissions assigned to the plurality of third-party applications, each of the plurality of permission levels defining a particular enforcement of the plurality of enforcements.

36. The method of claim 35, wherein, the role based access control mechanism utilizes the plurality of access permissions encompassed in the specific role to implement each of the plurality of enforcements to constrain the operation of the plurality of third-party applications.

37. A storage management server for protecting data, the storage management server comprising:

a set of one or more processors to execute operations of the storage management server, comprising a management module, a network module, and a data module, wherein;

the storage management server is configured to store, manage, and retrieve data in a set of mass storage devices on behalf of one or more network storage clients, the network module is configured to enable the storage management server to communicate with the one or more network storage clients, and the data module is configured to manage data retrieval and storage in the set of mass storage devices;

the storage management server establishes a sandbox to operate a plurality of third-party applications by implementing a plurality of enforcements to constrain operation of the plurality of third-party applications within a controlled set of the storage management server'"'"'s resources;

the storage management server implements the plurality of enforcements by establishing a specific role for the sandbox in a role based access control mechanism of the storage management server, wherein the third-party applications are entirely enabled and operable from within the storage management server as a native service offered from within the storage management server independent of and without need for communication with any third-party servers for operation of the third-party application, and wherein the third-party applications are configured to provide services related to the providing of data access services by the storage management server to the one or more network storage clients;

the sandbox uses the role based access control mechanism to constrain operation of each of the plurality of third-party applications within the controlled set of the storage management'"'"'s resources; and

the sandbox enables the plurality of third-party applications to be operated within the storage management server without requiring use of an additional computer to operate each of the plurality of applications; and

a memory coupled to the one or more processors to store the plurality of applications.