Policy engine to control the servicing of requests received by a storage server

• US 7,778,981 B2
• Filed: 02/11/2004
• Issued: 08/17/2010
• Est. Priority Date: 12/01/2000
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Uren, James T., Armitano, Robert M., Mihajlovic, Dejan L., Thompson, Timothy J., Yoder, Alan G., Muhlestein, Mark
• Primary Examiner(s): Jalil; Neveen Abel
• Assistant Examiner(s): Chbouki; Tarek
• Application Number:
  US10/777,418
• Publication Number:
  US 20040230795A1
• Time in Patent Office: 2,379 Days
• Field of Search: 707/204, 707/205
• US Class Current: 707/694
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Certain tasks are outsourced from a filer to a remote policy engine. The policy engine implements various defined policies to control the filer'"'"'s servicing of client requests. For example, the policy engine can be used to implement policies to control various storage-related operations relating to data managed by a filer, such as creation, deletion, modification, opening, closing, renaming and/or changing attributes of files or directories managed by the filer.

Claims

1. A method comprising:

receiving at a network storage server, from a network storage client, a client request to perform an operation relating to a data set stored by the network storage server;

in response to receiving the client request, determining in the network storage server whether to invoke a policy engine in relation to the client request, by determining whether the client request satisfies a specified criterion associated with a specified policy of the policy engine;

if the client request is determined not to satisfy a specified criterion associated with a specified policy of the policy engine, then satisfying the client request by the network storage server without invoking the policy engine;

whereas

if the client request is determined to satisfy a specified criterion associated with a specified policy of the policy engine, then

sending a screen request corresponding to the client request from the network storage server to the policy engine to cause the policy engine to apply the specified policy in relation to the client request or the data set;

receiving at the network storage server, from the policy engine, a screen response indicating a result of the policy engine having applied the specified policy in relation to the client request or the data set; and

sending a response to the client request from the network storage server to the network storage client in accordance with the screen response.

2. A method as recited in claim 1, wherein the policy engine is implemented as a dedicated application server separate from the network storage server.

3. A method as recited in claim 1, further comprising:

sending information relating to the data set to the policy engine with the screen request.

4. A method as recited in claim 3, wherein the information relating to the data set comprises metadata of the data set.

5. A method as recited in claim 1, wherein the screen request comprises a remote procedure call (RPC).

6. A method as recited in claim 1, wherein the network storage server and at least a portion of the policy engine are implemented in a single physical platform.

7. A method as recited in claim 1, wherein the client request is a request for a file managed by the network storage server.

8. A method as recited in claim 1, wherein the policy engine determines whether to approve or deny the screen request based on an identity of the network storage client.

9. A method as recited in claim 1, wherein the policy engine determines whether to approve or deny the screen request based on an identity of a user of the network storage client.

10. A method as recited in claim 1, wherein the policy engine determines whether to approve or deny the screen request based on an identity of the network storage server.

11. A method as recited in claim 1, wherein the policy engine determines whether to approve or deny the screen request based on a quota.

12. A method as recited in claim 1, wherein the policy engine determines whether to approve or deny the screen request based on a number of times the data set has been accessed during a period of time.

13. A method as recited in claim 1, further comprising:

using one of a plurality of storage protocols implemented by the network storage server to access the set of data, the plurality of storage protocols including a block-level storage protocol and a file-level storage protocol.

14. A system comprising:

a network storage server; and

a policy engine, implemented as a dedicated application server separate from the network storage server, coupled to communicate with the network storage server;

wherein the network storage server is configured to

receive a client request, from a network storage client, to perform an operation relating to a data set stored by the network storage server;

determine whether to invoke a policy engine, in response to receiving the client request, by determining whether the client request satisfies a specified criterion associated with a specified policy of the policy engine;

satisfy the client request, without invoking the policy engine, if the client request is determined not to satisfy a specified criterion associated with a specified policy of the policy engine;

invoke the policy engine, if the client request is determined to satisfy a specified criterion associated with a specified policy of the policy engine, by sending a screen request, corresponding to the client request, to the policy engine;

wherein the policy engine is configured to

receive the screen request from the network storage server;

wherein the screen request is configured to cause the policy engine to apply the specified policy in relation to the client request or the data set; and

send a screen response indicating a result of the policy engine having applied the specified policy in relation to the client request or the data set;

receive the screen response from the policy engine; and

send a response to the network storage client in accordance with the screen response.

15. A system as recited in claim 14, wherein the network storage server is further configured to:

send information relating to the data set to the policy engine with the screen request.

16. A system as recited in claim 15, wherein the information relating to the data set comprises metadata of the data set.

17. A system as recited in claim 14, wherein the screen request comprises a remote procedure call (RPC).

18. A system as recited in claim 14, wherein the client request is a request for a file managed by the network storage server.

19. A system as recited in claim 14, wherein the policy engine is further configured to determine whether to approve or deny the screen request based on an identity of the network storage client.

20. A system as recited in claim 14, wherein the policy engine is further configured to determine whether to approve or deny the screen request based on an identity of a user of the network storage client.

21. A system as recited in claim 14, wherein the policy engine is further configured to determine whether to approve or deny the screen request based on an identity of the network storage server.

22. A system as recited in claim 14, wherein the policy engine is further configured to determine whether to approve or deny the screen request based on a quota.

23. A system as recited in claim 14, wherein the policy engine is further configured to determine whether to approve or deny the screen request based on a number of times the data set has been accessed during a period of time.

24. A system comprising:

a plurality of network storage servers; and

a plurality of policy engines, each coupled to communicate with each of the network storage servers;

wherein each of the network storage servers is configured so that, in response to receiving a client request to perform an operation relating to a stored data set, the network storage server responds by

determining whether at least one of the policy engines should be invoked in relation to the client request, by determining whether the client request satisfies a specified criterion associated with a specified policy of at least one of the policy engines;

if the client request is determined not to satisfy a specified criterion associated with a specified policy of at least one of the policy engines, the network storage server responds by satisfying the client request;

whereas

if the client request is determined to satisfy a specified criterion associated with a specified policy of at least one of the policy engines, the network storage server responds by

sending a screen request corresponding to the client request from the network storage server to at least one of the policy engines to cause at least one of the policy engines to apply a specified policy in relation to the client request or the data set;

receiving at the network storage server a screen response indicating a result of applying the specified policy; and

sending a response to the client request from the network storage server to a network storage client in accordance with the screen response.

25. A system as recited in claim 24, wherein the network storage server is configured to select a particular one or more of the policy engines which should be invoked in response to determining that at least one of the policy engines should be invoked.

26. A system as recited in claim 25, wherein the network storage server stores a plurality of specified criteria associated with a corresponding plurality of specified policies, and wherein the network storage server is configured to select at least one of the policy engines which should be invoked, based on which one or more of the specified criteria are satisfied by the client request.

27. A system as recited in claim 25, wherein the network storage server is configured to select at least one of the policy engines which should be invoked based on a round-robin selection scheme.

28. A system as recited in claim 25, wherein the network storage server is configured to select at least one of the policy engines which should be invoked based on a load-balancing scheme.

29. A system as recited in claim 24, wherein each of the policy engines is dedicated to applying a different set of one or more policies.

30. A system as recited in claim 24, wherein at least one of the policy engines is configured to apply a specified policy in a manner that is dependent on which network storage server received the client request.

31. A system as recited in claim 24, wherein at least one of the policy engines is configured to determine whether to apply a particular specified policy based on which network storage server received the client request.

32. A system as recited in claim 24, wherein at least one of the policy engines applies a specified policy based on an identity of a client which sent the client request.

33. A system as recited in claim 24, wherein the plurality of policy engines are implemented as a cluster.

34. A system as recited in claim 24, wherein at least one of the policy engines comprises a cluster.