Cache-free and lock-free handling of security information for multiple distributed objects in protection storage systems
View Patent ↗A native protection storage operating system (PSOS) process receives a request specifying an operation having security related implications for elements in the PSOS having a first set of components handling data transfer operations and a second set of components handling configuration operations. A security component stores an identifier of the requester and a security related information element locally within a storage location of the first or second set of components, and accesses, upon receiving the request, the security related information element and requester identifier to match other elements of the network impacted by the request, and performs a security condition specific check to determine whether or not the request is to be allowed or denied. The native process eliminates a need for caching, locking, and chain propagation of the security related information through the PSOS.
1. A method comprising:
receiving a request from a requester of a plurality of requesters, the request specifying an operation having security related information for elements in a network encompassing a protection storage operating system (PSOS), the PSOS having a first set of components handling data access operations and a second set of components handling configuration operations;
storing, through a storage processing function of the PSOS, an identifier of the requester and a security related information element locally within a storage location of the first or second set of components;
accessing, upon receiving the request in a security function of the PSOS, the security related information element and requester identifier to match other elements of the network impacted by the request; and
performing, by the security function, a security condition specific check to determine whether or not the request is to be allowed or denied, wherein the PSOS comprises a data domain operating system (DDOS), and wherein the first set of components handling data access operations comprises data domain file system (DDFS) components and the second set of components handling configuration operations comprises at least one of an alerts component, a secure multi-tenancy (SMT) component, a systems management services (SMS) component, and a role-based access control (RBAC) component, and wherein the storage location of the first set of components comprises a data structure stored in a first persistent memory device and configured to store attribute information of the requester and the security related information, and wherein the storage location of the second set of components comprises a registry stored in a second persistent memory device.
2. The method of claim 1 wherein PSOS comprises a purpose-built backup appliance (PBBA) cluster comprising a plurality of PBBA nodes.
3. The method of claim 2 wherein the storage of security related information in a persistent memory location of each component of the PSOS eliminates a need for caching, locking, and chain propagation of the security related information through the PSOS.
4. The method of claim 1 wherein the security condition specific check comprises determining whether other elements of the network impacted by the request are matched through at least one of the identifier of the requester, the security related information element stored locally within the storage locations of the first or second set of components.
5. The method of claim 4 further comprising generating a dependency matrix for the request comprising a relational coupling of the requester and the other elements of the network impacted by the request.
6. The method of claim 2 wherein the PSOS comprises part of a multi-tenant network, and wherein the plurality of requesters each comprise a tenant unit accessing executable applications, data files and configuration information stored on storage devices coupled to the network through partitions defined for each tenant unit of a plurality of tenant units.
7. A system comprising:
an interface to a protection storage device within a protection storage operating system (PSOS), the PSOS having a first set of components handling data access operations and a second set of components handling configuration operations, and configured to receive a request specifying an operation having security related information impacting elements in the PSOS;
a first set of components handling data access operations within the PSOS, each component of the first set of components storing, in first storage locations, user access and corresponding security related information, for operations impacting respective components of the first set of components;
a second set of components handling configuration operations within the PSOS, each component of the second set of components storing, in second storage locations, user access and corresponding security related information for operations impacting respective components of the second set of components; and
a security component accessing, upon receipt of the operation, the first and second storage locations to determine appropriate access credentials and identifiers of the impacted elements of the PSOS to deny or allow the request, wherein the PSOS comprises a data domain operating system (DDOS), and wherein the first set of components handling data access operations comprises data domain file system (DDFS) components and the second set of components handling configuration operations comprises at least one of an alerts component, a secure multi-tenancy (SMT) component, a systems management services (SMS) component, and a role-based access control (RBAC) component, and wherein the storage location of the first set of components comprises a data structure stored in a first persistent memory device and configured to store attribute information of the requester and the security related information, and wherein the storage location of the second set of components comprises a registry stored in a second persistent memory device.
8. The system of claim 7 wherein PSOS comprises a purpose-built backup appliance (PBBA) cluster comprising a plurality of PBBA nodes.
9. The system of claim 7 wherein the storage of security related information in a persistent memory location of each component of the PSOS eliminates a need for caching, locking, and chain propagation of the security related information through the PSOS.
10. The system of claim 9 wherein the security component, upon receipt of the operation, generates a dependency matrix for the request comprising a relational coupling of a requester transmitting the request and the impacted elements of the PSOS.
11. The system of claim 8 wherein the PSOS comprises a data domain operating system (DDOS), and wherein the first set of components handling data access operations comprises data domain file system (DDFS) components, and wherein at least one of the nodes is a data domain restorer (DDR) appliance.
12. The system of claim 7 wherein the security component executes a security condition specific check that determines whether elements of the PSOS impacted by the request are matched through at least one of the identifier of the requester, the security related information element stored locally within the first storage locations or second storage locations.
13. The system of claim 7 wherein at least one of the nodes comprising a PBBA accesses a memory of the storage devices and performs at least one of backup, archiving, and disaster recovery operations for at least one of a plurality of tenant units.
14. The system of claim 9 wherein the request comprises at least one of a data access operation involving a data read or write operation, and a configuration request involving a control or update operation performed on a resource of the PSOS.
15. A computer program product comprising a non-transitory computer usable medium having machine readable code embodied therein for:
receiving a request from a requester of a plurality of requesters, the request specifying an operation having security related information for elements in a network encompassing a protection storage operating system (PSOS), the PSOS having a first set of components handling data access operations and a second set of components handling configuration operations;
storing, through a storage processing function of the PSOS, an identifier of the requester and a security related information element locally within a storage location of the first or second set of components;
accessing, upon receiving the request in a security function of the PSOS, the security related information element and requester identifier to match other elements of the network impacted by the request; and
performing, by the security function, a security condition specific check to determine whether or not the request is to be allowed or denied, wherein the PSOS comprises a data domain operating system (DDOS), and wherein the first set of components handling data access operations comprises data domain file system (DDFS) components and the second set of components handling configuration operations comprises at least one of an alerts component, a secure multi-tenancy (SMT) component, a systems management services (SMS) component, and a role-based access control (RBAC) component, and wherein the storage location of the first set of components comprises a data structure stored in a first persistent memory device and configured to store attribute information of the requester and the security related information, and wherein the storage location of the second set of components comprises a registry stored in a second persistent memory device.