Device access control in a distributed storage system
AssigneePure Storage, Inc.
InventorsPrabir Paul, Vinod Jayaraman
Life of this patent
Estimating the term…
Abstract
An example method for device access control in a distributed storage system comprises receiving, by a driver of a device, a command from a process to open the device; and denying, by the driver of the device, access to the device for the process at least until an input/output (I/O) control command comprising a token is received. When the I/O control command comprising the token is received, the driver may determine, based on the token, that the process is authorized to access the device and grant access to the device for the process.
Claims16
A method comprising:
- receiving, by a driver of a device and from a process external to the device, a command to open the device, the device comprising a storage volume;
- denying, by the driver of the device and based on the receiving the command to open the device, additional commands transmitted to the device from the process at least until an input/output (I/O) control command comprising a token is received;
- receiving, by the driver of the device, the I/O control command comprising the token;
- providing, by the driver of the device to a storage management system configured to manage the storage volume, the token;
- receiving, from the storage management system and based on the token received via the I/O control command, an indication that the process is authorized to access the device;
- storing a process identifier (PID) associated with the process;
- and
- granting, based on the receiving the indication, access to the device by verifying additional PIDs associated with the additional commands to the device with the PID associated with the process.
A system comprising:
- one or more memories storing computer-executable instructions;
- and
- one or more processors to execute the computer-executable instructions to perform an operation comprising:
- receiving, by a driver of a device and from a process external to the device, a command to open the device, the device comprising a storage volume;
- denying, by the driver of the device and based on the receiving the command to open the device, additional commands transmitted to the device from the process at least until an input/output (I/O) control command comprising a token is received;
- receiving, by the driver of the device, the I/O control command comprising the token;
- providing, by the driver of the device to a storage management system configured to manage the storage volume, the token;
- receiving, from the storage management system and based on the token received via the I/O control command, an indication that the process is authorized to access the device;
- storing a process identifier (PID) associated with the process;
- and
- granting, based on the receiving the indication, access to the device by verifying additional PIDs associated with the additional commands to the device with the PID associated with the process.
A non-transitory, computer-readable medium storing computer instructions that, when executed, direct one or more processors of one or more computing devices to perform an operation comprising:
- receiving, by a driver of a device and from a process external to the device, a command to open the device, the device comprising a storage volume;
- denying, by the driver of the device and based on the receiving the command to open the device, additional commands transmitted to the device from the process at least until an input/output (I/O) control command comprising a token is received;
- receiving, by the driver of the device, the I/O control command comprising the token;
- providing, by the driver of the device to a storage management system configured to manage the storage volume, the token;
- receiving, from the storage management system and based on the token received via the I/O control command, an indication that the process is authorized to access the device;
- storing a process identifier (PID) associated with the process;
- and
- granting, based on the receiving the indication, access to the device by verifying additional PIDs associated with the additional commands to the device with the PID associated with the process.
Dependencies are inferred from the claim text.