Network Appliance, Inc.

Netapp, Inc.

James Hartwell Holl, Ii

Timothy J Thompson

James J Voll

Anshu Surana

William Raoul Durant

Kaladhar Voruganti

Steven Robert Kleiman

Gokul Soundararajan

Konstantinos Roussos

Shailaja Kamila

Kartik Kumar

Ravindra Kumar

Peter Logan Smoot

Sahn Lam

Subramaniam Mohan

Hemanth Pannem

Anawat Chanhunthod

Bill Raoul Durant

Technology is disclosed for managing network storage services by service level objectives (SLOs). The method receives multiple service level capability (SLC) templates; creates at least one storage service level (SSL) instance using at least one of the SLC templates; provisions a storage object located in a network storage infrastructure based on the SSL instance; and services storage requests using the storage object.

Network storage management at scale using service level objectives

A method, apparatus, and system are described herein, in which system resources and operations are assigned to roles in a role-based access control system, and the roles are assigned to a plurality of users. An RBAC system is used to resolve the client request to perform an operation on a resource, the RBAC system using a hierarchy of the plurality of resources to determine if a user is permitted to perform the operation on a parent of the resource in the hierarchy of resources. The RBAC system also determines if a user is permitted to perform the operation on the resource if a user group to which the user belongs to has the required access.

Hierarchy-aware role-based access control

An embodiment of a network manager permits a resource group administrator (with resource group level permissions but without global permissions) to add a global object to his/her resource group as a managed object, without requiring the administrator to have a global permission, as discussed further below. An embodiment of the network manager permits a resource group administrator to also edit the configuration settings that are attached to his/her resource group without requiring the administrator to have a global permission.

De-centralization of group administration authority within a network storage architecture

A method and an apparatus to increase conformance of a storage implementation of a data set to a storage policy are presented. In one embodiment, the method includes performing a conformance check of a data set state and an associated data management policy. The method includes identifying a set of tasks that can be performed to increase conformance of the data set state to the associated policy, and generating a task list using tasks from the set of tasks. The method further includes outputting an indication of the task list to a user and accepting from the user an approval of the task list before generating and executing a second task list.

Request processing for stateless conformance engine

Methods and systems for mapping data-management requirements to the provisioning of a data storage system to conform to a set of user-defined data-management policies. A conformance engine with storage system awareness translates the set of data-management policies to a corresponding set of storage-provisioning policies and provisions the resources of the storage system thereby to conform the storage system to the data-management policies. A conformance checker continuously and automatically compares the provisioning of the storage system resources to the provisioning required to meet the data-management policies. When nonconformance is detected, the conformance engine automatically re-provisions the available resources of the storage system to conform the storage system to the data management policies.

Automated continuous provisioning of a data storage system

A storage system includes a storage space provisioning system coupled to a primary storage server and a secondary storage server to resize a thin provisioned secondary volume on the secondary storage server. The storage space provisioning system detects data stored on a primary volume that is to be transferred to a secondary volume and obtains a point-in-time copy of the data stored on the primary volume. The storage provisioner determines a maximum transfer size of the data to be transferred using the point-in-time copy, and compares the maximum transfer size to a difference between the thin provisioned size of the secondary volume and a used size of the secondary volume. The storage space provisioning system increases the thin provisioned size of the secondary volume to be greater than the used size of the secondary volume plus the maximum transfer size when the maximum transfer size is greater than the difference.

Reserving a thin provisioned space in a storage system

Described herein is a centralized access request authorization system comprising an authorization module, one or more server systems, and a collection of one or more storage systems connected through a network. An application executing on a server system receives an access request for accessing the storage system collection and sends an authorization request to the authorization module for authorizing the access request. The application may be configured to only send the access request to the storage system collection if it first receives an authorization of the access request from the authorization module. Since the application is configured to do such, the storage system performs the access request without performing any authorization verification on the access request. The authorization module may receive authorization requests from a plurality of applications (executing on a plurality of server systems) and determine received authorization requests using a single repository of access permission information.

Centralizing access request authorizations for storage systems

In an RBAC system, a capability is defined as including an operation and an object on which the operation is to be performed. The capability is assigned to a role, which is in turn assigned to a user. Whether a user's request to perform an operation on an object should be authorized is determined based on whether a capability to perform the operation on the object is assigned to a role which is in turn assigned to the user. Further, the authorization is determined based on the evaluation of the constraint(s) attached to the role. If the evaluation result of the constraint(s) disallows the user to assume the role, the user is prohibited from performing the operation on the object even the user has such capability.

Method and system of access control based on a constraint controlling role assumption

In an RBAC system, a capability is defined as including an operation and an object on which the operation is to be performed. The capability is assigned to a role, which is in turn assigned to a user. Then the user will have the authorization to perform the operation on the object. Rather than specifying the object by predetermining the identity of the object, an expression (e.g., a regular expression, a query, etc.) may be specified in place of the predetermined object. In response to a request initiated by a user, the expression is then evaluated to determine the identity of the object(s) on which the operation may be performed.

Growing community of inventors

Los Gatos, CA, United States of America

James Hartwell Holl, Ii