Resource fencing for vLAN multi-tenant systems
First Claim
1. In a storage system having a plurality of nodes, the nodes being grouped into a plurality of cluster systems each having multiple nodes, each cluster system being logically partitioned into a plurality of namespaces, each namespace including a collection of data objects, each cluster system having multiple tenants, each tenant being a grouping of namespaces, each cluster system having a plurality of capabilities, at least some of the capabilities being bound to the tenants, a node in the cluster system comprising:
- a memory, anda controller operable to bind each capability to one of a plurality of IP networks so that each capability is bound to only one of the IP networks and has a destination IP address of the IP network to which the capability is bound;
wherein it is permissible for one or more capabilities to be bound to the same IP network;
wherein each IP network has one corresponding network interface;
wherein each capability is a resource that is bound to one of (i) the cluster system or (ii) a replication interface of the cluster system or (iii) one of the tenants of the cluster system; and
wherein the controller is operable, in response to a request for a capability received via the corresponding network interface of one of the IP networks, to;
find an IP network which is bound to the capability being requested by the request and determine whether an IP address of the IP network at which the request is received is in an address range allocated to the found IP network;
if the IP address of the IP network at which the request is received is in an address range allocated to the found IP network, grant access by the request to the requested capability; and
if the IP address of the IP network at which the request is received is not in an address range allocated to the found IP network, deny access by the request to the requested capability.
3 Assignments
0 Petitions
Accused Products
Abstract
A storage system has a plurality of nodes which are grouped into a plurality of cluster systems each having multiple nodes, each cluster system being logically partitioned into a plurality of namespaces, each namespace including a collection of data objects, each cluster system having multiple tenants, each tenant being a grouping of namespaces, each cluster system having a plurality of capabilities, at least some of the capabilities being bound to the tenants. A node in the cluster system comprises: a memory, and a controller operable to bind each capability to one of a plurality of IP networks so that each capability is bound to only one of the IP networks and has a destination IP address of the IP network to which the capability is bound. It is permissible for one or more capabilities to be bound to the same IP network. Each IP network has one corresponding network interface.
-
Citations
9 Claims
-
1. In a storage system having a plurality of nodes, the nodes being grouped into a plurality of cluster systems each having multiple nodes, each cluster system being logically partitioned into a plurality of namespaces, each namespace including a collection of data objects, each cluster system having multiple tenants, each tenant being a grouping of namespaces, each cluster system having a plurality of capabilities, at least some of the capabilities being bound to the tenants, a node in the cluster system comprising:
-
a memory, and a controller operable to bind each capability to one of a plurality of IP networks so that each capability is bound to only one of the IP networks and has a destination IP address of the IP network to which the capability is bound; wherein it is permissible for one or more capabilities to be bound to the same IP network; wherein each IP network has one corresponding network interface; wherein each capability is a resource that is bound to one of (i) the cluster system or (ii) a replication interface of the cluster system or (iii) one of the tenants of the cluster system; and wherein the controller is operable, in response to a request for a capability received via the corresponding network interface of one of the IP networks, to; find an IP network which is bound to the capability being requested by the request and determine whether an IP address of the IP network at which the request is received is in an address range allocated to the found IP network; if the IP address of the IP network at which the request is received is in an address range allocated to the found IP network, grant access by the request to the requested capability; and if the IP address of the IP network at which the request is received is not in an address range allocated to the found IP network, deny access by the request to the requested capability. - View Dependent Claims (2, 3, 4)
-
-
5. A method for managing access to capabilities, in a storage system having a plurality of independent nodes, the nodes being grouped into a plurality of cluster systems each having multiple nodes, each cluster system being logically partitioned into a plurality of namespaces, each namespace including a collection of data objects, each cluster system having multiple tenants, each tenant being a grouping of namespaces, each cluster system having a plurality of capabilities, at least some of the capabilities being bound to the tenants, a node in the cluster system including a memory and a controller, the method comprising:
-
binding each capability to one of a plurality of IP networks so that each capability is bound to only one of the IP networks and have a destination IP address of the IP network to which the capability is bound; and in response to a request for a capability received via the corresponding network interface of one of the IP networks; finding an IP network which is bound to the capability being requested by the request and determining whether an IP address of the IP network at which the request is received is in an address range allocated to the found IP network; if the IP address of the IP network at which the request is received is in an address range allocated to the found IP network, granting access by the request to the requested capability; and if the IP address of the IP network at which the request is received is not in an address range allocated to the found IP network, denying access by the request to the requested capability; wherein it is permissible for one or more capabilities to be bound to the same IP network; wherein each IP network has one corresponding network interface; and wherein each capability is a resource that is bound to one of (i) the cluster system or (ii) a replication interface of the cluster system or (iii) one of the tenants of the cluster system. - View Dependent Claims (6, 7, 8, 9)
-
Specification