Systems and methods for defining storage

Patent metadata

Field	Value
Publication number	US-10129162-B1
Application number	US-201514716689-A
Country	US
Kind code	B1
Filing date	May 19, 2015
Priority date	Oct 9, 2014
Publication date	Nov 13, 2018
Grant date	Nov 13, 2018

Abstract

System and methods are provided for providing modular control of network data packet handling and configurations. In one aspect, a storage-to-network mapping data structure is provided that can translate network connection parameters into high level, searchable concepts. In turn, these searchable concepts can be used by one or more modular software-defined storage applications to provide rules for network traffic handling that can then be merged into a dataplane forwarding data structure for implementation by a dataplane forwarder.

First claim

What is claimed is:

1. A machine-implemented method for a network, the method comprising:
generating a network connection data structure by an adapter coupled to a server, for communicating with a storage device on behalf of one or more storage tenants using a network connection to the network via the adapter; wherein a record from among a plurality of records of the network connection data structure identifies the network connection by a connection identifier, and includes a network access address for a storage volume, a network access address for a virtual machine, a virtual network identifier (VNET) and a port identifier identifying an adapter port used for the network connection;
generating by the adapter, a storage-to-network mapping data structure, the storage-to-network mapping data structure maps a storage tenant to the virtual network identifier stored at the network connection data structure, maps the virtual machine to the network access address of the virtual machine and the virtual network identifier, and maps the storage volume to the network access address of the storage volume, the virtual network identifier and the port identifier;
receiving by the adapter, a flow data structure comprising a set of network connection processing rules for the storage tenant, the storage volume and the virtual machine, wherein the flow data structure is received when a new application or a new security feature is introduced to access the storage device via the network connection;
combining by the adapter, the network connection data structure, the storage-to-network mapping data structure, and the flow data structure to generate a dataplane forwarding data structure, wherein the dataplane forwarding data structure provides a set of network packet processing rules that are used by a dataplane forwarder module of the adapter for processing a network packet; wherein the set of network processing rules are arranged by priority and define an action associated with each rule; and processing the network packet by the adapter, according to a rule from among the set of network processing rules of the dataplane forwarding data structure.

2. The method of claim 1 , wherein the network access address for the storage volume includes an Internet Protocol (IP) address and a media access control (MAC) address, and the network access address of the virtual machine is another IP address.

3. The method of claim 1 , wherein the flow data structure set of network processing rules comprise one or more of the following actions: grant access, deny access, and rate limit access.

4. The method of claim 1 , wherein the processing a network packet includes extracting packet metadata from the packet for look-up in the dataplane forwarding data structure.

5. The method of claim 1 , wherein the processing of the network packet comprises finding a first matching rule in the set of network packet processing rules and executing an action associated with that rule.

6. The method of claim 1 wherein the dataplane forwarding data structure further comprises a set of network counters related to one or more of the network packet processing rules.

7. The method of claim 1 further comprising:
updating the dataplane forwarding data structure with a new data flow data structure when another security feature or application is added to access the storage device.

8. A network device coupled to a computing device for communicating with a storage device on behalf of one or more storage tenants using a network connection to a network, comprising:
a network port;
a processor; and
memory for storing machine executable instructions, that, when executed by the processor, cause the device to:
generate a network connection data structure; wherein a record from among a plurality of records of the network connection data structure identifies the network connection by a connection identifier, and includes a network access address for a storage volume, a network access address for a virtual machine, a virtual network identifier (VNET) and a port identifier identifying an adapter port used for the network connection;
generate a storage-to-network mapping data structure, the storage-to-network mapping data structure maps a storage tenant to the virtual network identifier stored at the network connection data structure, maps the virtual machine to the network access address of the virtual machine and the virtual network identifier, and maps the storage volume to the network access address of the storage volume, the virtual network identifier and the port identifier;
receive a flow data structure comprising a set of network connection processing rules for the storage tenant, storage volume and the virtual machine, wherein the flow data structure is received when a new application or a new security feature is introduced to access the storage device via the network connection;
combine the network connection data structure, the storage-to-network mapping data structure, and the flow data structure to generate a dataplane forwarding data structure, wherein the dataplane forwarding data structure provides a set of network packet processing rules that are used by a dataplane forwarder module of the adapter for processing a network packet; wherein the set of network processing rules are arranged by priority and define an action associated with each rule; and
process the network packet according to a rule from among the set of network processing rules of the dataplane forwarding data structure.

9. The network device of claim 8 , wherein the network access address for the storage volume includes an Internet Protocol (IP) address and a media access control (MAC) address, and the network access address of the virtual machine is another IP address.

10. The network device of claim 8 , wherein the flow data structure set of network processing rules comprise one or more of the following actions: grant access, deny access, and rate limit access.

11. The network device of claim 8 , wherein the processing a network packet includes extracting packet metadata from the packet for look-up in the dataplane forwarding data structure.

12. The network device of claim 8 , wherein the processing of the network packet comprises finding a first matching rule in the set of network packet processing rules and executing an action associated with that rule.

13. The network device of claim 8 wherein the dataplane forwarding data structure further comprises a set of network counters related to one or more of the network packet processing rules.

14. The network device of claim 8 further comprising instructions to:
update the dataplane forwarding data structure with a new data flow data structure when another security feature or application is added to access the storage device.

15. A non-transitory machine readable storage medium having stored thereon instructions for performing a method for a network, comprising machine executable code which when executed by at least one machine, causes the machine to:
generate a network connection data structure by an adapter coupled to a server for communicating with a storage device on behalf of one or more storage tenants using a network connection to the network via the adapter; wherein a record from among a plurality of records of the network connection data structure identifies the network connection by a connection identifier, and includes a network access address for a storage volume, a network access address for a virtual machine, a virtual network identifier (VNET) and a port identifier identifying an adapter port used for the network connection;
generate by the ada

Assignees

• Qlogic Corp
• Cavium Llc

Inventors

• Faulk Jr Robert Lee

Classifications

• H04L47/33 Primary

  using forward notification · CPC title

• H04L47/20

  Traffic policing · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title

• G06F3/0635

  by changing the path, e.g. traffic rerouting, path reconfiguration · CPC title

• G06F3/0607

  by facilitating the process of upgrading existing storage systems, e.g. for improving compatibility between host and storage device · CPC title