System and method for implementing data migration while preserving security policies of a source filer

• US 9,300,692 B2
• Filed: 08/27/2013
• Issued: 03/29/2016
• Est. Priority Date: 08/27/2013
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Beard, Derek, Hsiao, Duen-Wen
• Primary Examiner(s): Vaughan, Michael R
• Assistant Examiner(s): MCCOY, RICHARD ANTHONY
• Application Number:
  US14/011,723
• Publication Number:
  US 20150067759A1
• Time in Patent Office: 945 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 16/119 Details of migration of file systems migration mechanisms in storage systems G06F3/0647
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A data migration system in which security policies of a source file system are preserved, in an environment in which clients actively issue communications for the source filer while data is migrated to a destination file system.

Claims

1. A method for data migration, the method being implemented by one or more processors and comprising:

implementing a data migration in which a data migration system migrates data from a source file system to a destination file system;

intercepting, at the data migration system, a file system operation request for one or more file system objects on a volume of the source file system from a client while the data migration is in progress;

determining a set of credentials for the client from the intercepted file system operation request;

creating one or more reference file system objects on the volume of the source file system corresponding to the file system operation request, wherein each of the one or more reference file system objects are assigned a separate permission level and do not affect the data migration;

issuing a test request from the data migration system to the source file system to access, using the client'"'"'s set of credentials, the one or more reference file system objects on the volume of the source file system;

determining permission levels associated with the volume for the client based on a response received from the source file system to the test request to access the one or more reference file system objects on the volume of the source file system; and

based on the determined permission levels, implementing a security policy at the data migration system, on behalf of the destination file system, for file system operation requests intercepted from the client at the data migration system that are intended for the volume.

2. The method of claim 1, further comprising creating a test file as one of the reference file system objects.

3. The method of claim 2, wherein the test file corresponds to a root access level file system object.

4. The method of claim 2, wherein the test file corresponds to an unrestricted file system object used to determine read-only access.

5. The method of claim 1, wherein determining the set of credentials includes determining a set of Remote Procedure Call (RPC) credentials for each client.

6. The method of claim 5, wherein issuing the test request using the client'"'"'s set of credentials includes issuing the test request using the identified RPC credentials.

7. The method of claim 1, wherein implementing the security policy includes implementing an Internet-Protocol (IP) based security policy.

19. The method of claim 1, wherein receiving the file system operation request occurs during a cutover phase of data migration.

8. A data migration system comprising:

a memory that stores a set of instructions;

one or more processors that use the instructions to;

migrate data from a source file system to a destination file system;

intercept a file system operation request for one or more file system objects on a volume of the source file system from a client during data migration;

determine a set of credentials for the client from the intercepted file system operation request;

create one or more reference file system objects on the volume of the source file system corresponding to the file system operation request, wherein each of the one or more reference file system objects are assigned a separate permission level and do not affect the data migration;

issue a test request from the data migration system to the source file system to access, using the client'"'"'s set of credentials, the one or more reference file system objects on the volume of the source file system;

determine permission levels associated with the volume for the client based on a response received from the source file system to the test request to access the one or more reference file system objects on the volume of the source file system; and

based on the determined permission levels, implement a security policy at the data migration system, on behalf of the destination file system, for file system operation requests intercepted from the client at the data migration system that are intended for the volume.

9. The data migration system of claim 8, wherein the one or more processors create a test file as one of the reference file system objects.

10. The data migration system of claim 9, wherein the test file corresponds to a root access level file system object.

11. The data migration system of claim 9, wherein the test file corresponds to an unrestricted file system object used to determine read-only access.

12. The data migration system of claim 8, wherein the one or more processors determine the set of credentials by determining a set of Remote Procedure Call (RPC) credentials for each client.

13. The data migration system of claim 12, wherein the one or more processors issue the test request using the client'"'"'s set of credentials by issuing the test request using the identified RPC credentials.

14. The data migration system of claim 8, wherein the one or more processors implement the security policy by implementing an Internet-Protocol (IP) based security policy.

20. The data migration system of claim 8, wherein the data migration system receives the file system operation request during a cutover phase of data migration.

15. A non-transitory computer-readable medium that stores instructions, executable by one or more processors, to cause the one or more processors to perform operations that comprise:

implementing a data migration in which a data migration system migrates data from a source file system to a destination file system;

intercepting, at the data migration system, a file system operation request for one or more file system objects on a volume of the source file system from a client while the data migration is in progress;

determining a set of credentials for the client from the intercepted file system operation request;

creating one or more reference file system objects on the volume of the source file system corresponding to the file system operation request, wherein each of the one or more reference file system objects are assigned a separate permission level and do not affect the data migration;

issuing a test request from the data migration system to the source file system to access, using the client'"'"'s set of credentials, the one or more reference file system objects on the volume of the source file system;

determining permission levels associated with the volume for the client based on a response received from the source file system to the test request to access the one or more reference file system objects on the volume of the source file system; and

based on the determined permission levels, implementing a security policy at the data migration system, on behalf of the destination file system, for file system operation requests intercepted from the client at the data migration system that are intended for the volume.

16. The computer-readable medium of claim 15, further comprising instructions for creating a test file as one of the reference file system objects.

17. The computer-readable medium of claim 16, wherein the test file corresponds to a root access level file system object.

18. The computer-readable medium of claim 16, wherein the test file corresponds to an unrestricted read-only access file system object.