Methods and systems for role based access control in networked storage environment

Patent metadata

Field	Value
Publication number	US-2016188898-A1
Application number	US-201514695362-A
Country	US
Kind code	A1
Filing date	Apr 24, 2015
Priority date	Dec 31, 2014
Publication date	Jun 30, 2016
Grant date	—

Abstract

Methods and systems for role based access control (RBAC)) by a management device are provided. The management device communicates with a plurality of application plugins executed by one or more host computing devices through a management interface layer for managing backup, restore and clone operations involving objects that are stored on behalf of the plurality of applications by a storage system. The plurality of applications and the storage system have different RBAC requirements. The management device generates a token and the same token is used for RBAC across any of the applications and the storage system.

First claim

What is claimed is:

1 . A machine implemented method, comprising:
managing role based access control (RBAC) by a management device that communicates with a plurality of application plugins executed by one or more computing devices interfacing with the plurality of applications for managing backup, restore and cloning operations involving objects that are stored on behalf of the plurality of applications by a storage system, where the management device interfaces with the plurality of application plugins via a management interface layer executed by the computing devices, and the plurality of applications and the storage system have different RBAC requirements; generating a token for a user by the management device, where the token is used for RBAC across any of the applications and the storage system; and assigning a role to the user from among a plurality of roles that determines an access type and based on the role the user is granted the access type to a stored object and a storage service associated with the storage object is enabled by the management device.

2 . The method of claim 1 , wherein the plurality of roles include a backup operator that is permitted to take a backup, a backup viewer that can only view a backup, and a restore administrator that is permitted to restore a storage volume.

3 . The method of claim 2 , wherein an administrator using the management device creates a custom role, modifies an existing role and deletes an existing role.

4 . The method of claim 1 , wherein the token is based on user credentials and is encrypted.

5 . The method of claim 1 , wherein after the user is authenticated, the user is assigned a storage connection that enables access to a stored object.

6 . The method of claim 1 , wherein the management layer uses a local RBAC cache to cache information regarding roles and storage connections for a user of a computing device to determine user rights and permissions for backup restore, and cloning operations that are managed by the management device.

7 . The method of claim 1 , wherein the management device maintains a plurality of objects that store information regarding the computing devices, virtual machines and the plurality of plugins and based on permissions associated with the role assigned to the user, the user is permitted to execute an operation type involving any of the plurality of objects.

8 . A non-transitory, machine readable storage medium having stored thereon instructions for performing a method, comprising machine executable code which when executed by at least one machine, causes the machine to:
manage role based access control (RBAC) by a management device that communicates with a plurality of application plugins executed by one or host computing devices that interface with the plurality of applications for managing backup, restore and cloning operations involving objects that are stored on behalf of the plurality of applications by a storage system, where the management device interfaces with the plurality of application plugins via a management interface layer executed by the computing devices, and the plurality of applications and the storage system have different RBAC requirements; generate a token for a user by the management device, where the token is used for RBAC across any of the applications and the storage system; and assign a role to the user from among a plurality of roles that determines an access type and based on the role the user is granted the access type to a stored object and a storage service associated with the storage object is enabled by the management device.

9 . The storage medium of claim 8 , wherein the plurality of roles include a backup operator that is permitted to take a backup, a backup viewer that can only view a backup, and a restore administrator that is permitted to restore a storage volume.

10 . The storage medium of claim 9 , wherein an administrator using the management device creates a custom role, modifies an existing role and deletes an existing role.

11 . The storage medium of claim 8 , wherein the token is based on user credentials and is encrypted.

12 . The storage medium of claim 8 , wherein after the user is authenticated, the user is assigned a storage connection that enables access to a stored object.

13 . The storage medium of claim 8 , wherein the management layer uses a local RBAC cache to cache information regarding roles and storage connections for a user of a computing device to determine user rights and permissions for backup restore and cloning operations that are managed by the management device.

14 . The storage medium of claim 8 , wherein the management device maintains a plurality of objects that store information regarding the computing devices, virtual machines and the plurality of plugins and based on permissions associated with the role assigned to the user, the user is permitted to execute an operation type involving any of the plurality of objects.

15 . A system, comprising:
a memory containing machine readable medium comprising machine executable code having stored thereon instructions; and a processor module of a management device coupled to the memory, the processor module configured to execute the machine executable code to: manage role based access control (RBAC) by a management device that communicates with a plurality of application plugins executed by one or more computing devices that interface with the plurality of applications for managing backup, restore and cloning operations involving objects that are stored on behalf of the plurality of applications by a storage system, where the management device interfaces with the plurality of application plugins via a management interface layer executed by the computing devices, and the plurality of applications and the storage system have different RBAC requirements; generate a token for a user by the management device, where the token is used for RBAC across any of the applications and the storage system; and assign a role to the user from among a plurality of roles that determines an access type and based on the role the user is granted the access type to a stored object and a storage service associated with the storage object is enabled by the management device.

16 . The system of claim 15 , wherein the plurality of roles include a backup operator that is permitted to take a backup, a backup viewer that can only view a backup, and a restore administrator that is permitted to restore a storage volume and an administrator using the management device creates a custom role, modifies an existing role and deletes an existing role.

17 . The system of claim 15 , wherein the token is based on user credentials and is encrypted.

18 . The system of claim 15 , wherein after the user is authenticated, the user is assigned a storage connection that enables access to a stored object.

19 . The system of claim 15 , wherein the management layer uses a local RBAC cache to cache information regarding roles and storage connections for a user of a computing device to determine user rights and permissions for backup restore, cloning operations that are managed by the management device.

20 . The system of claim 15 , wherein the management device maintains a plurality of objects that store information regarding the host computing devices, virtual machines and the plurality of plugins and based on permissions associated with the role assigned to the user, the user is permitted to execute an operation type involving any of the

Assignees

• Netapp Inc

Inventors

• Karinta Vineeth
• Lolayekar Santosh C
• Pillai Jayakrishnan Ramakrishna

Classifications

• G06F2201/80

  Database-specific techniques · CPC title

• G06F16/188

  Virtual file systems · CPC title

• G06F16/172

  Caching, prefetching or hoarding of files · CPC title

• G06F16/951

  Indexing; Web crawling techniques · CPC title

• G06F16/183

  Provision of network file services by network file servers, e.g. by using NFS, CIFS (network file access protocols H04L67/1097) · CPC title