Emc Corporation

Jason Glasgow

Sorin Faibish

Per W Brashers

Xiaoye Jiang

Eyal Zimran

James M Pedone, Jr

James Pedone

Mario Wurzl

A data processing system includes host data processors, a data storage system including data storage shared among the host data processors, and a data switch coupling the host data processors to the data storage system. The data storage system has host adapter ports coupled to the data switch. The data switch is programmed for distributing block I/O requests from the host data processors over the operable host adapter ports for load balancing of the block I/O requests among the operable host adapter ports. The shared data storage can be a file system striped across RAID sets of disk drives for load balancing upon disk director ports of the data storage system. The data processing system can be expanded by adding more data storage systems, switches for the additional data storage systems, and switches for routing block I/O requests from the host processors to the data storage systems.

Shared storage access load balancing for a large number of hosts

Embodiments of the present invention provide a method of managing access of multiple client computers to a storage system that supports a limited number of logins. The method comprises, in response to a request to enable a subset of the clients to access resources of the storage system to perform a task, automatically configuring the storage system to provide the subset of the clients access to the resources, and, when the task is completed, automatically re-configuring the storage system so that the subset of the clients is no longer provided with access to the resources of the storage system.

Automatic access management of clients to a storage system

Embodiments of the present invention are directed to techniques for selecting a data path over which to exchange information between a client device and a storage system by making a selection between a file system server (NAS) data path type (a first data path type) and a direct (SAN) data path type (a second data path type) based on one or more adjustable path selection factors and/or information regarding components of the computer system. For example, a data path may be selected based on a likelihood that requested information will be in a cache of a file system server and/or any other suitable path selection factor.

Selection of a data path based on the likelihood that requested information is in a cache

For enhanced access control, a client includes a token in each read or write command sent to a block storage device. The block storage device evaluates the token to determine whether or not read or write access is permitted at a specified logical block address. For example, the token is included in the logical block address field of a SCSI read or write command. The client may compute the token as a function of the logical block address of a data block to be accessed, or a metadata server may include the token in each block address of each extent reported to the client in response to a metadata request. For enhanced security, the token also is a function of a client identifier, a logical unit number, and access rights of the client to a particular extent of file system data blocks.

Access control to block storage devices for a shared disk based file system

Embodiments of the present invention are directed to techniques for selecting a data path over which to exchange information between a client device and a storage system by making a selection between a file system server (NAS) data path type (a first data path type) and a direct (SAN) data path type (a second data path type) based on one or more adjustable path selection factors and/or information regarding components of the computer system. For example, a data path may be selected based on a type of an input/output operation to be executed (i.e., whether the operation is a read operation or write operation) and/or any other suitable path selection factor.

Selection of a data path based on operation type

An access control agent is advantageously deployed at a host device to prevent malicious use of a storage system by unauthorized hosts and users. In one embodiment the access control agent is disposed in a processing path between the application and the storage device. An application is mounted as an image file by a loop device to provide a virtual file system. The virtual file system is populated with access control information for each block of the file. Application I/O requests are mapped to physical blocks of the storage by the loop device, and the access control information is used to filter the access requests to preclude unauthorized requests from being forwarded to the storage client (and consequently the storage devices). With such an arrangement, access rights can be determined at I/O accesses, file and block granularity for each user.

System and method for providing access control to raw shared devices

Embodiments of the present invention are directed to techniques for selecting a data path over which to exchange information between a client device and a storage system by making a selection between a file system server (NAS) data path type (a first data path type) and a direct (SAN) data path type (a second data path type) based on one or more adjustable path selection factors and/or information regarding components of the computer system. For example, a data path may be selected based on one or more performance characteristics of a computer system in which a path selection module is acting and/or any other suitable path selection factor.

Growing community of inventors

Newton, MA, United States of America

Jason Glasgow