Managing access to block storage in cloud computing environments

Patent metadata

Field	Value
Publication number	US-11914877-B2
Application number	US-202117513300-A
Country	US
Kind code	B2
Filing date	Oct 28, 2021
Priority date	Oct 28, 2021
Publication date	Feb 27, 2024
Grant date	Feb 27, 2024

Abstract

Systems and methods for managing access to a block device. An example method includes receiving, by a processing device from an entity operating in a cloud-computing environment, a memory access command referencing a block device of a distributed storage system that is accessible by a plurality of entities of the cloud computing environment; identifying a data structure associated with the referenced block device, wherein the data structure identifies entities of the cloud-computing environment that are allowed access to the block device; determining, in view of the data structure, whether the entity is allowed access to the block device by the memory access command; and responsive to determining that the entity is allowed access to the block device by memory access command, executing the memory access command.

First claim

What is claimed is:

1. A method comprising:
capturing, by a processing device monitoring network traffic from an entity of a plurality of entities operating in a cloud-computing environment, a memory access command of a particular type, the memory access command referencing an address range;
determining that the address range is associated with a block device of a distributed storage system that is accessible by the plurality of entities;
identifying a data structure associated with the block device, wherein the data structure identifies entities of the cloud-computing environment that are allowed access to the block device;
determining, in view of first metadata maintained in the data structure, whether the entity is allowed access to the block device by the memory access command;
responsive to determining that the entity is allowed access to the block device by the memory access command, determining, in view of second metadata maintained in the data structure, whether the entity is allowed access to the block device by the type of the memory access command; and
responsive to determining that the entity is allowed access to the block device by the type of the memory access command, executing the memory access command.

2. The method of claim 1 , further comprising;
detecting a new entity added to the cloud-computing environment; and
adding, to the data structure, metadata indicative of access permissions by the new entity with respect to the block device.

3. The method of claim 2 , wherein the new entity is a clone of the entity and references the block device.

4. The method of claim 1 , further comprising:
maintaining metadata, in the data structure, indicative of access permissions for each memory access command type by the entity with respect to the block device.

5. The method of claim 1 ,
wherein the type of the memory access command comprises at least one of a read command, a write command, modify command, or an erase command.

6. The method of claim 5 , further comprising:
responsive to determining that the entity is not allowed access to the block device using the type of memory access command, denying access to the block device.

7. The method of claim 1 , further comprising:
responsive to determining that the entity does not have access to the block device, denying access to the block device.

8. The method of claim 1 , wherein the entity comprises an execution environment, a client, or a host system.

9. The method of claim 1 , wherein a client of a plurality of clients operating in a cloud-computing environment is enabled to set access permissions in the data structure.

10. A system comprising: a memory; and
a processing device, operatively coupled to the memory, the processing device configured to:
capture, by monitoring network traffic from an entity of a plurality of entities operating in a cloud-computing environment, a memory access command of a particular type, the memory access command referencing an address range;
determine that the address range is associated with a block device of a distributed storage system that is accessible by the plurality of entities;
identify a data structure associated with the block device, wherein the data structure identifies entities of the cloud-computing environment that are allowed access to the block device;
determine, in view of first metadata maintained in the data structure, whether the entity is allowed access to the block device by the memory access command;
responsive to determining that the entity is allowed access to the block device by the memory access command, determining, in view of second metadata maintained in the data structure, whether the entity is allowed access to the block device by the type of the memory access command; and
responsive to determining that the entity is allowed access to the block device by the type of the memory access command, execute the memory access command.

11. The system of claim 10 , wherein the processing device is further configured to;
detect a new entity added to the cloud-computing environment; and
add, to the data structure, metadata indicative of access permissions by the new entity with respect to the block device.

12. The system of claim 11 , wherein the new entity is a clone of the entity and references the block device.

13. The system of claim 10 , wherein the processing device is further configured to:
maintain metadata, in the data structure, indicative of access permissions for each memory access command type by the entity with respect to the block device.

14. The system of claim 10 ,
wherein the type of the memory access command comprises at least one of a read command, a write command, modify command, or an erase command.

15. The system of claim 14 , wherein the processing device is further configured to:
responsive to determining that the entity is not allowed access to the block device using the type of memory access command, deny access to the block device.

16. The system of claim 10 , wherein the processing device is further configured to:
responsive to determining that the entity does not have access to the block device, deny access to the block device.

17. The system of claim 10 , wherein the entity comprises an execution environment, a client, or a host system.

18. The system of claim 10 , wherein a client of a plurality of clients operating in a cloud-computing environment is enabled to set access permissions in the data structure.

19. A non-transitory computer readable medium comprising instructions, which when accessed by a processing device, cause the processing device to:
capture, by monitoring network traffic from an entity of a plurality of entities operating in a cloud-computing environment, a memory access command of a particular type, the memory access command referencing an address range;
determine that the address range is associated with a block device of a distributed storage system that is accessible by the plurality of entities;
identify a data structure associated with the block device, wherein the data structure identifies entities of the cloud-computing environment that are allowed access to the block device;
determine, in view of first metadata maintained in the data structure, whether the entity is allowed access to the block device by the memory access command;
responsive to determining that the entity is allowed access to the block device by the memory access command, determining, in view of second metadata maintained in the data structure, whether the entity is allowed access to the block device by the type of the memory access command; and
responsive to determining that the entity is allowed access to the block device by the type of the memory access command, execute the memory access command.

20. The non-transitory computer readable medium of claim 19 , wherein the processing device is further configured to:
detect a new entity added to the cloud-computing environment; and
add, to the data structure, metadata indicative of access permissions by the new entity with respect to the block device.

Assignees

• Red Hat Inc

Inventors

• Talmor Avraham
• Gersht Ilan
• Bregman Arie

Classifications

• G06F3/064 Primary

  Management of blocks · CPC title

• G06F3/0604

  Improving or facilitating administration, e.g. storage management · CPC title

• G06F3/0622

  in relation to access · CPC title

• G06F3/0659

  Command handling arrangements, e.g. command buffers, queues, command scheduling · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title