SERVICE ORIENTED DATA MANAGEMENT AND ARCHITECTURE

[0001] This application claims the benefit of priority under 35 USC 119(e) of U.S. Provisional Patent Application No. 62/099,673 filed on Jan. 5, 2015, the contents of which are incorporated herein by reference in their entirety.

[0002] The present invention, in some embodiments thereof, relates to service oriented distributed data management with associated architecture and, more particularly, but not exclusively, to such a system that uses content and metadata to manage the data.

[0003] Today the amount of storage keeps on growing exponentially, with major growth in new storage fronts such as cloud and BigData, and future growth trends with the emergence of the internet of things (IoT). In the new age data is dynamic, can move or replicate between different physical locations, can move between faster solid state storage or slower mechanical hard drives (HDD) based on usage patterns, and needs to be shared by many clients or applications, whether they are sensors, mobile phones, tablets, PCs, or application servers.

[0004] To date, most storage of data is block storage. Data is blindly arranged in blocks with no reference to the content. Multiple level storage can follow usage patterns as mentioned above to place more frequently used pieces of data in faster storage while keeping all of the data in main storage. Firewalls and other network control devices can inspect packets and direct data transfer according to the results, which may occasionally relate to the content, but there is no equivalent in data storage and management once beyond the bounds of networking.

[0005] The present trends suggest a different approach to storage, no longer silos of single vendor block storage mapped to a single client or application, but rather an adoption of highly scalable file or object based globally networked storage, which can serve many clients or applications, and connect to multiple local, remote, or cloud based storage resource islands/pools from a variety of vendors and be managed as a service.

[0006] Today there are some file sharing solutions in the form of NAS (Network Attached Storage) or even clustered/scale-out NAS solutions which have internal storage and support file access protocols, those however are limited in scale, provide only basic file management data services, and focus on local deployments.

[0007] Some new object storage solutions exist as local clusters or in the form of cloud storage, and examples include Amazon S3, Google Drive, and Dropbox, all of which are quite scalable, but are still limited in performance and in the data services that they provide, have limited consistency, and do not allow mixing various storage resources. The main use of those services is for backup and archiving and not as a form of enterprise storage or a way to unify different storage resources or protocols under the same governance.

[0008] Given the huge variety of potential clients and applications, each requiring different storage services, or different priorities, and the enormous scale and variety of the underlying storage resources, the management paradigm may be expected to change from the present day black box type of management which is agnostic to the data content.

[0009] The present embodiments may provide a service oriented distributed data resource management layer, which may in turn provide security, appropriate service levels, data lifecycle management, and features/functionality required by individual clients or applications or a group of such. Data is managed as data objects or groups of objects, based on content and metadata and the different protocols through which the data arrives, or management may be based on metadata which the system stores about those objects, and the protocols are mapped to a common data semantic in which features can be selected for highly granular data management policies. The features can be from the content, from the metadata, from the session history, information to do with the data source or the source history and the like and can be arranged into policies in advance, or dynamically as required. The data management and processing can be done in a distributed fashion, multiple data control and processing elements can be scattered locally and globally, those divide the data name space among them so each control element would only process a relevant portion of the data objects, thereby gaining scalability, higher level controller entities can distribute and synchronize the data management policies across all data processing elements. The data management and processing can be distributed and implemented in a cascading or topology driven fashion in which the same traffic or objects are processed by multiple stages and each stage may implement a portion of the data classification or processing tasks.

[0010] According to an aspect of some embodiments of the present invention, there is provided a method of managing data, comprising:

[0011] identifying data objects, the data objects having attributes;

[0012] unpackaging said objects, said unpackaging comprising mapping said attributes to a common semantic;

[0013] using said common semantic, obtaining features of said data objects;

[0014] defining at least one data management policy for data objects using said features and said common semantic, said data management policy defining a feature-based sequence of data management actions defining data management that varies for different objects depending on respective features; and

[0015] applying said at least one policy to objects of said application or protocol according to said features as appearing in individual objects, thereby to carry out said data management for each object individually.

[0016] According to an aspect of some embodiments of the present invention, there is provided a method of managing data, comprising:

[0017] identifying data objects having respective features, and an associated policy, said associated policy being a data management policy for data objects using said features, said data management policy defining a feature-dependent sequence of data management actions providing data management that varies for different objects depending on said respective features;

[0018] obtaining said respective features of given data objects;

[0019] applying at least one data management action to one of said data objects based on said at least one policy and according to features of said one data object; and

[0020] managing said individual objects according to said policy and said respective features.

[0021] Data streams and objects can be scattered across a plurality of data processing elements which may reside in one or more locations, and each data processing element may manage and process all the data objects or a subset of the data objects or a subset of the data streams to gain scalability. One or more higher level data controllers may distribute the data management policies to the individual data processing elements.

[0022] Unless otherwise defined, all technical and/or scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the invention pertains. Although methods and materials similar or equivalent to those described herein can be used in the practice or testing of embodiments of the invention, exemplary methods and/or materials are described below. In case of conflict, the patent specification, including definitions, will control. In addition, the materials, methods, and examples are illustrative only and are not intended to be necessarily limiting.

[0023] Implementation of the method and/or system of embodiments of the invention can involve performing or completing selected tasks manually, automatically, or a combination thereof. Moreover, according to actual instrumentation and equipment of embodiments of the method and/or system of the invention, several selected tasks could be implemented by hardware, by software or by firmware or by a combination thereof using an operating system.

[0024] For example, hardware for performing selected tasks according to embodiments of the invention could be implemented as a chip or a circuit. As software, selected tasks according to embodiments of the invention could be implemented as a plurality of software instructions being executed by a computer using any suitable operating system. In an exemplary embodiment of the invention, one or more tasks according to exemplary embodiments of method and/or system as described herein are performed by a data processor, such as a computing platform for executing a plurality of instructions. Optionally, the data processor includes a volatile memory for storing instructions and/or data and/or a non-volatile storage, for example, a magnetic hard-disk and/or removable media, for storing instructions and/or data. Optionally, a network connection is provided as well. A display and/or a user input device such as a keyboard or mouse are optionally provided as well.

[0039] The present invention, in some embodiments thereof, relates to a data management method and system and more particularly, but not exclusively, to a data management method and system that uses features within or associated with data objects to manage the data objects with high granularity in a distributed environment.

[0040] Data arrives in a session to be managed in various ways. Data management may involve different ways of storage, of making the data available to users, of backing up, replicating or keeping the data up to date, of taking snapshots, of providing redundancy and otherwise securing the data and of disposing of old and unwanted data. Data management may involve hierarchical arrangement of the data in layered storage, and data belonging to different users or data of different kinds may be managed in different ways. In one embodiment, rules belonging to different groups may be arranged in a hierarchy, for example rules handling data belonging to different users may form one group and rules for handling different kinds of data may be placed in another group, and then a hierarchical relationship between the two groups may be defined in order to solve conflicts between contradictory rules.

[0041] The position of the data in a hierarchy may be considered to be part of associated metadata.

[0042] A session in the present context is any framework in which data objects arrive, and the session has session attributes which define what the data is or where it comes from or where it is going or what to do with it and the like. The data can be tagged and the tags can be used to decide what to do with the data in the management system, that is to say to determine what policies apply. The policies may assign one or more present or future actions to the data.

[0043] To address the need for faster storage access, new mesh or edge/core data management topologies are being designed, similar to the way very large server networks are built, and the present embodiments allow the data management layer to try and manage or filter or cache the data in-flight in a more application aware manner, reducing the overhead and scalability challenges of current applications and reducing the dependency on network bandwidth or latency. When doing so there is even a greater need for scalable data management approaches which can guarantee a consistent view of the data, and provide consistent policy and data processing regardless of where the data may have come from or where it is being stored.

[0044] Today there is a wide variety of data access protocols which range from file oriented access, for example NFS, CIFS, WebDAV, FTP, . . . to object protocols such as Rest, Amazon S3, OpenStack Swift, and then there are other application specific protocols such as Hadoop HDFS and HBASE, and in many cases different clients may try and access the same file or object through different protocols. There is thus provided in accordance with some of the present embodiments the ability to map the attributes, including protocol attributes, of the incoming data to a common data transaction semantic, process the data requests according to the appropriate policy, and then read or store the data in the relevant storage resource which can also use different interfaces ranging from block protocols such as SCSI, SATA, iSCSI, FC, or file protocols, or object protocols, or memory semantics. In any service oriented data management layer there may be segregation between the access or storage media protocol and the data security, tiering, and retention etc policies.

[0045] Unpackaging and mapping may involve stripping away the specific structure or packaging of incoming data, and separating the content itself from the associated metadata. The metadata is stored in a uniform manner and associated with the content so that the content can be managed on a high granularity basis.

[0046] A preferred part of managing a service is the ability to constantly monitor the service usage and behavior, as part of a service oriented data management layer in which analytical data on the data access patterns, faults, capacities, usage, etc. may be collected.

[0047] Such data can be used by the system users or administrators or can be used by the system itself to adapt its behavior in a proactive manner, an example would be to migrate a storage resource closer to the actual user, or slow down or disconnect an abuser accessing shared data.

[0048] The present embodiments may thus provide a distributed, software defined, service oriented data management layer allowing many different clients and applications in different places using different access protocols to access large amounts of data stored in a variety of storage resources in different locations, while abstracting, securing, optimizing, monitoring, modifying, and managing the lifecycle of the data in a consistent way, and potentially embedding higher level data services in a scalable and fully programmable fashion.

[0049] In the present embodiments there may be multiple data controller elements, which distribute or replicate the storage namespace among them, and may provide flexible front-end connectivity to support any protocol or access pattern. The controller elements may be themselves controlled through a set of match/action based rules (similar to network packet routers) focused on data objects and services, and can store the data in variety of local or remote storage resources with difference performance or cost characteristics. Controller elements or portions of them may be arranged in a cascade with multiple stages, each such controller stage may implement parts of the data classification or data management action enabling greater scalability of the system.

[0050] In addition, there may be provided a control layer which processes and distributes the desired data services and access policies to the different data controller nodes. The processing can be distributed based on the origin of the data transactions or based on the data objects name space, or based on any other combinations.

[0051] By using flexible match/action rules the control layer may apply any type of data management behavior/function to any data object or object category or user or protocol or combination. This allows a software defined data management path, with enormous flexibility and granular control compared to the common practice today which is rigid and allows a limited set of actions per object or file directory. The policy may consist of a set of match/action rules which can be ordered according to the priority of each rule. This way if there are conflicts between rules or a partial match the rules with the higher priority wins. Multiple policy rules can be grouped together by application or through a usage scenario, and may be added or updated or removed in an atomic fashion to guarantee consistent policy behavior and simpler management. Having a flexible and software defined policy may provide for managing of shared data especially when addressing distributed, dynamic and large scale environments, with a variety of workloads each requiring different services.

[0052] Before explaining at least one embodiment of the invention in detail, it is to be understood that the invention is not necessarily limited in its application to the details of construction and the arrangement of the components and/or methods set forth in the following description and/or illustrated in the drawings and/or the Examples. The invention is capable of other embodiments or of being practiced or carried out in various ways.

[0053] Referring now to the drawings, FIG. 1 is a simplified diagram illustrating a method 10 of managing data according to an embodiment of the present invention. The method involves identifying 12 an application or protocol or data source or interface or the like to which the data to be managed relates. The objects have their own features which may have to do with the associated application or protocol etc, and the semantics are identified and mapped 14 on to a common semantic, as the object is unpackaged.

[0054] The common semantic may then be used to obtain features or metadata or content of data objects and identify a nearby data processing element to process that object policy. As will be explained below, the features or metadata or content may be found in the objects themselves or may relate to the network source, network source attributes, or users, including a user identity, or sessions or applications or protocols relating to the objects. Depending on the protocol or application, the data objects may be files, databases, database entries, data records, media streams, log or event streams, time series data, messages, OOP objects, data packets, or any other organizational unit of data. The features may be used to define 16 a data management policy or policies for object or type of object. When an individual object requires data management services, then features relating to the object are extracted 18, and then used to apply the policy so as to manage or service the object.

[0055] The features may be taken from the object content, from metadata either contained within the object or otherwise relating to the object, session history, information to do with the data source; information to do with the history of the data source, information to do with the protocol or application itself or any other information source that is available and relevant to management of the data.

[0056] In one embodiment the policy is ready in advance of receipt of a data object requiring data management or data services. In an alternative a policy may be provided dynamically with initial presentation of the objects. Data management relates to a data management system say at enterprise level or data management at the cloud level, and may involve defining availability of particular data objects so that the policy defines availability of the objects in terms of the object features.

[0057] Data management may relate to storage of the data objects in a flexible storage hierarchy, so that the policy relates hierarchy levels to object features.

[0058] The policies may be applied to parts of objects, again based on features. Thus, for example if the object is an article having a headnote and detailed text, then the availability of the headnote may be set higher than that of the detailed text. In this way, flexibility of the data management allows advantage to be taken of the levels of the data storage hierarchy.

[0059] Likewise, data management may relate to synchronization of the data objects with other objects elsewhere, and the policy may relate synchronization actions to features of the data objects.

[0060] Likewise, data management may relate to obtaining snapshots or a backup or archiving so that the snapshot or backup or archiving is governed by features relating to the objects.

[0061] The data management may include defined actions, and the data management method may involve attaching one or more of the defined actions to a data object according to the features of the object and the associated policy. The actions may be carried out by the backend logic but some, say the simpler actions, may be carried out at the front end to offload logic from the backend. Actions carried out at the front end may be carried out immediately upon data arrival and may use preset rules which do not depend on the central mapping.

[0062] The same object may have more than one policy applied thereto, each defining actions. The policies may be arranged in a hierarchy so that in the event of conflict between two actions, the action whose policy is higher in the hierarchy succeeds.

[0063] Reference is now made to FIG. 2, which illustrates a further method 30 for managing data according to an embodiment of the present invention. In FIG. 2, the object is identified 32, and the associated policy is obtained 34. Then the features relating to the object are obtained 36 and an action is then added 38 to the policy or directly to the object. In box 40 the action is applied to manage the object.

[0064] As discussed with respect to FIG. 1, the application or protocol has attributes; and the attributes are mapped to a common semantic, which serves as the basis for identifying features. The features belonging to the object, the session, the attributes or the originating protocol or application as a whole are used to obtain the policy, which may be software defined per individual user or session or in any other way for the application or protocol.

[0065] The action may be applied according to rules of the policy.

[0066] Examples of actions include any of the following: a routing action, a block action, a redirect action, a mirror action, a mapping action, a data caching action, a data pre-fetching action, a data tiering action, a snapshot action, a copy on write action, a data compression action, a data encryption action, a data deduplication action, a content filtering action, a pattern matching action, a remote notification action, a remote replication action, a QOS action, a QOS action defining bandwidth limits, a QOS action defining bandwidth guarantees, a QOS action defining priority, a QOS action defining limits or guarantees on the number of data or IO transactions per second, a QOS action defining a data size, a QOS action defining a data growth rate, a QOS action defining warning events, a tag set action, a tag increment action, a tag decrement action, a set attribute tag action, a data content processing action, generation of custom logs or reports action, and a function call action and a default action.

[0067] There may also be a set of actions that do not happen in the context of the incoming transaction, and these include examples such as: periodic backups or archiving of the data, which may operate according to a given schedule, periodic snapshots, periodic data synchronization between repositories, periodic report generation, periodic or schedule based data movement, automated data deletion, e.g. based on file aging from its creation data or last usage, periodic incremental replication, say in which after every n minutes the delta or changes are sent, tiering which may involve moving data between different storage classes based on the historical usage pattern combined with user policies, processing of the data content and transforming the content into a new form as a batch operation.

[0068] The different actions may be associated with elements in a control layer and the actions may operate their corresponding elements to manage the object.

[0069] The embodiments are now considered in greater detail, with respect to FIGS. 3 to 7.

[0070] FIG. 3 is a simplified diagram illustrating a system architecture that allows multiple API's and protocols to use scaled out data services and flexible resource options according to an embodiment of the present invention. The data services are provided in a pipeline, and the client options allow for the central protocol to cater for native apps using an FES library. The pipeline includes flexible client options for unified storage and resource sharing. The options include FES gateways which map any client or API or protocol into the protocol that is distributed in the system fabric and defines object transactions. Native applications 52 correspond to items in a FES library 54, and such an arrangement may provide for integration with commonly used big-data applications or applications commonly associated with data such as Hadoop, Spark, MongoDB, Redis, also MySQL, Oracle, SAP, Cassandra, and OpenStack (Cinder/Swift/Manilla) also Video streamers and FSI.

[0071] A low latency fabric with distributed consistency 56 connects to scaled out data services 58 which are designed to provide scalability and performance which are potentially unlimited. A data pipe service (DPS) 60 provides parallel processing and smart read/write caching of storage transactions and services. There may be numerous individual pipelines 62.1 . . . 62.n. Object store service (OSS) 64 comprises a variety of pluggable storage options mapped into a primitive k/V object API or file abstraction. Three OSS logic instances 66 are shown. The architecture further provides flexible storage and resource options which are decoupled from processing, and which are used for tiering, capacity scaling and migration. The three options provided are direct, networked and cloud. Direct provides the lowest cost and highest density solution. Networking provides for greater reliability, scalability and is compatible with legacy applications. Cloud provides backup, archiving, synchronization and sharing options. The architecture can be scaled to include new storage options as they are introduced.

[0072] FIG. 4 is a simplified diagram showing the data pipeline service (DPS) architecture of FIG. 3. FES clients are first classified in classifier 70 and assigned a software defined policy. The policy may be defined per network addresses or per protocol or per user, or per object name or path or type and/or metadata. Data objects may be rejected, delayed or steered using filters, using QoS-based quotas or using redirection at unit 72. Transaction management unit 74 ensures that consistency is provided despite transactions being distributed in the fabric. In particular transaction management includes ordering, versioning, taking snapshots, indexing, locking, managing atomic transactions, etc. Tier 0 read/write cache 76 provides lowest latency writes and cached reads, and provides data together with a policy to placement logic 78 which may now carry out application aware data placement. OSS providers 80 then carry out compression, encryption, checksum, deduplication, load balancing, RAID/Erasure and defragmentation under control of the DPS.

[0073] FIG. 5 is a simplified diagram showing a system view of an embodiment of the present invention. A front end application or protocol gateway 90, with sample application listed, leads to datapipe servers 92, with sample operations shown and finally to object storage service 94, with sample storage operations shown. The datapipe servers are divided into in memory transaction processor cache 96 and a data placement service 98.

[0074] Data transport is bidirectional, and the outward direction from object storage 94 may avoid the data placement service 98.

[0075] FIG. 6 is a simplified diagram illustrating elasticity within the data management services to allow for scalability, according to an embodiment of the present invention. A zero-latency high speed system fabric 100 supports elastic data gateways and applications 102, elastic data processing and caching services 104, elastic REST API and web UI services 106, elastic data processing and caching services 108, cluster management 110, log/alarms 112, persistency control 114, identity control 116, and monitoring 118. Stateless load balancing 120 for incoming requests allows use of multiple sites 122 and makes use of varied and potentially unlimited storage resources 124 including commodity, enterprise, hardware and cloud.

[0076] FIG. 7 is a simplified block diagram showing different data management policies and how they may relate to applications and assignment of resources according to embodiments of the present invention. Data objects arrive from a variety of applications 130, of which several examples are shown and then pass through three levels 132, 134 and 136 of data management policies. Finally the objects are assigned to resources 138, again a few examples being shown. The data management policies of the first level 132 include a firewall, QoS, content filters and applications, and a virtual namespace. The second level 134 includes permissions and quotas, which may act via the first level policies. The third level includes snapshot, archive and delete, optimize and replicas and data reproduction.

[0077] FIG. 8 is a simplified diagram describing a resource hierarchy. A potential logical arrangement of the object data is made into data containers, each data container being sub-divided into slices (shards) which are stored on local or shared storage resources. Data containers are associated with policies, and can belong to a tenant, and data containers can be replicated in multiple locations. The data is actually stored in shared object storage resources (OSS) 140. The slices or shards 142 are made up of data from containers 144 which share policies 146 and which each belong to specified tenants 148. The tenants are associated with users 150. The slices or shards 142 of the container 144 data may be mirrored globally or locally and may be distributed based on application, hash product or file or database hierarchy or the like.

[0078] The containers may be of different types and may have policies/ACLs, and distributed group objects to handle hierarchical relations, file directories, tables, indexes, and distributed transactions.

[0079] Each tenant may have multiple containers and multiple users. The container data may be sliced into groups and hierarchies 152 including nested groups such as a directory structure.

[0080] FIG. 9 is a simplified diagram describing how data management and state can be distributed in local or global proximity to address performance, scalability, and availability. The slices of FIG. 8 are assigned as N slices per container. N may depend on the total number containers and a minimum number of slices. Node numbers are assigned based on type, estimated size etc. Close proximity is preferred for load balancing when containers have to remain consistent, for example files and databases. Replicas may be placed in close by nodes, say on the same rack, and remote nodes. One group or MDS slice per container may be present on each node. The figure illustrates the placing of consistent data on different nodes of the same rack for performance and on a geographically distant zone for fault tolerance.

[0081] FIG. 10 is a simplified block diagram showing how a data object state and/or content can be synchronized and replicated in a local cluster. In 1 the FES data is written to a local DPS master. There may be several masters and the correct master for the object may be used. In 2 the DPS master synchronizes with DPS masters in other zones and with slaves. In 3 the slaves acknowledge the synchronization/replication in the write cache, but do not at this stage use storage resources. In 4 an acknowledgement is sent to the user. In 5, after a delay, the data is written to the storage resource OSS. In 6 the OSS acknowledges and the copy is marked in an extent tree. In 7, for shared access OSS, other DPS's that are involved are notified of the data placement and may use the data in case of failure. The arrangement allows for faster rebuilds and less impact on regular data processing.

[0082] FIG. 11 is a simplified block diagram showing how a data object state and/or content can be synchronized in a global cluster. Data replication with global distribution may involve 1 writing to a local DPS master, who may be selected per object type or Cgroup. In 2 the DPS synchronizes with slaves and with DPS masters from other zones.

[0083] In 3 the slaves acknowledge the synchronization or replication.

[0084] In 4 an acknowledgement is sent to the user.

[0085] In 5 the DPS's from other zones accept the copy of the data.

[0086] In 6 non-parked data is confirmed, and in 7, when shared access OSS stores the data, all other DPSs are notified about the new copy, as in the local example above.

[0087] Reference is now made to FIG. 12, which is a conceptual system diagram of an embodiment of the present application. A system for managing data 200 mediates between an external world of data objects 202 from numerous different applications and users, and a distributed storage infrastructure 204. An object of the system 200 is to obtain data, and carry out application and object aware processing and storage of the data.

[0088] Data objects entering the system 200 are distinguished from each other in having content and attributes and coming from given users or given locations, be they absolute locations or logical locations. An identifying unit 206 is provided to identify the data objects.

[0089] An unpackaging unit 208 unpacks the objects, in the sense of looking for attributes and the like, whether or not they were used in the identification, and maps those attributes onto a common semantic 210. The common semantic may be a single generalized library of attributes describing all the expected protocols, and the common semantic allows the system to obtain features of the data objects.

[0090] A classifying unit 212 uses the features and the common semantic 210 and finds a data management policy for any given data object. The data management policy may define a feature-based sequence of data management actions and the sequence that is provided may be different for different objects, so that each object is treated according to a management sequence that is suitable for the type of object. This is known as object-aware data management.

[0091] Management unit 214 applies the policy selected by the management unit to the various objects of any given application or protocol and carries out the data management for each object individually. Thus, some objects may be checked for viruses and compressed and then put in long term storage. Other objects may be distributed into high availability databases etc.

[0092] The system is bi-directional and also allows for object-aware management functions when the data is retrieved to the external world.

[0093] Feedback between different stages may be implemented. A data management action may set a common semantic attribute associated with said object, that may be used in subsequent operations. A policy may drive the system to update an object attribute, and that attribute can be classified by the following stages in the processing phases to further drive new actions, or the new attribute may serve as an input to the classification and be taken into account when later following messages arrive. The features of the present embodiments are now considered in greater detail and may include the following:

• • [0094] Front-end Protocol/Application gateways service (FES)
    • [0095] Map the application/protocol specific semantics into the data pipeline fabric APIs and identify a data pipeline service (DPS) which will process the data, FES is stateless and the objects state and cache is maintained by the DPS
    • [0096] There can be multiple FES types and protocols:
      • [0097] File system gateways: NFS, CIFS, HTTP, FTP, WebDAV, Local (VFS/POSIX) APIs
      • [0098] Object gateways: REST, Swift, S3, Librados (Ceph)
      • [0099] Block: iSCSI, iSER, FC, SAS, SATA, Local block device emulation.
      • [0100] Key/value store APIs, or database record access APIs
      • [0101] API library for native integration with any 3^rd party applications.
    • [0102] Some of the policy, for example access control and partial classification, can be executed by the FES gateway this way offloading the back-end processing and minimizing the flow of redundant or unwanted traffic.
  • [0103] Data Pipeline Service Nodes/Cluster (DPS)
    • [0104] Manage the storage transactions and storage objects
    • [0105] Low-latency, distributed, consistent/transactional data flow pipeline
    • [0106] Real-time policy based data filtering, indexing, tiering/routing, manipulating, and monitoring
    • [0107] Local NV-RAM or BBU (Battery Backed-up Unit) for write cache and metadata log/cache
    • [0108] Local SSD for metadata, fast storage and read cache
  • [0109] Object Storage Services (OSS) and Resources
    • [0110] Local DAS storage (with Object APIs such as LevelDB and/or local file-system such as BTRFS or EXT4 or NTFS)
    • [0111] SAN with mounted file system or Object APIs
    • [0112] NAS (mounted via NFS, CIFS, HDFS, . . . clients)
    • [0113] External Object storage: Ceph/librados, Swift, S3, . . . (via their native client)
    • [0114] Object Storage hardware such as Seagate Kinetic, FusionIO
    • [0115] Cloud Object storage (Amazon, Google, Dropbox, Ctera, . . . )
    • [0116] Remote/Disaster-recovery sites
  • [0117] Metadata Service (MDS)
    • [0118] Manage metadata filesystem/container operations
    • [0119] Directory or group operations (list, create/delete/ . . . , snapshot)
    • [0120] Mapping of file directory entries to iNodes/Objects
    • [0121] MDS is a distributed entity and can have instances across the system
  • [0122] Cluster Management and monitoring (CMS)
    • [0123] Highly available system and cluster management
    • [0124] Cluster management is in charge of managing all the services and policies in a local site, and potentially synchronizing with other cluster managers in different sites.
    • [0125] Managed via open REST APIs
    • [0126] HTML5 based user interface
    • [0127] Object oriented CLI (command line interface)
    • [0128] Remote notifications and logging via standard mechanisms
    • [0129] Store and distribute policy to FES/DPS/MDS/OSS services in a consistent way
    • [0130] Multi-tenancy by design (support multiple tenants, each with its isolated view of the system)

[0131] Policy is stored per container, container belongs to an account/tenant.

[0132] The match Key can consist of some or all of the following fields, which make up the session attributes:

• • [0133] Session data
    • [0134] Source host/IP/subnet
    • [0135] Destination IP/Port
    • [0136] User/Group identity
    • [0137] Account/Tenant/Container/destination
    • [0138] Client protocol (e.g. NFS, CIFS, S3, . . . )
  • [0139] Object metadata Object Name, Object ID, Object Prefix, partial name/path Match
    • [0140] Type, category (e.g. “video files”)
    • [0141] Sub-object record id/name, column name
    • [0142] Current metadata tags (stored in the object)
    • [0143] hash of name+mask
  • [0144] Operation
    • [0145] Operation type: Read, write, create, delete, . . .
    • [0146] Offset in object, range
    • [0147] Requested time range
  • [0148] Object attr/xattr+value (tag)object content elements, or object field content

[0149] Policies have states to disable/enable.

[0150] The system can mark the user creating the policy, and/or restrict creation of certain rules to a subset of users. Policy can be organized by layers, layers can be restricted to view/modify by individual users, layers can be inherited from other containers and/or general user or tenant policy.

[0151] Actions can be grouped to policy or IO/app types/behaviors (to simplify for users).

[0152] A date and/or time range and expiration time may be associated with a policy rule (indicating a rule will only be active during that time).

Below are several classes of actions:

• • [0153] Offline (access is suspended)
  • [0154] Action
    • [0155] Default
    • [0156] Block
    • [0157] Redirect: to destination NAS/OSS+path+user w/o caching
    • [0158] Mirror: write async to both local and external storage/DR, specify Read/Write-mostly, mirrored IO done at first stage (pre), specify local and remote user/role
    • [0159] Copy on write: when objects are written copy the file to a new repository, otherwise read the objects from the original repository
    • [0160] Map: file share/mount point to path, optionally re-assign user/role
  • [0161] QoS:
    • [0162] Rx/Tx×IOPs/Bandwidth rate limits & guarantees, Priority
    • [0163] size increase/time, or objects created/time
    • [0164] optional warning events
  • [0165] Set Tag: set/inc/dec/stamp xattr tag when event occurs
  • [0166] Log the operation in different detail levels
  • [0167] Modify fields or content of the transaction
  • [0168] Callback or content processing: call a specific function/service when event occurs
    • [0169] Allow running custom procedure on read/write/open/ . . . (e.g. for data inspection, custom manipulation, pre-fetch logic . . . )

• • [0170] specify access permissions per role/group/user
  • [0171] apply to specific or all sub-folders
  • [0172] auditing

• • [0173] specify size and object # limits, warning levels per all/user/group
  • [0174] warnings sent to log and owner/admin (can be a general config)

• • [0175] described where and how data is stored or fetched to maximize cost/performance
    • [0176] Define primary storage tier (memory, Intensive Read (TLC), Intensive R/W (SSD), low-latency R/W (NVMe), Capacity (SATA), Cold, hybrid) and its properties
      • [0177] Storage pool (or auto selection)
      • [0178] Data protection level
    • [0179] Select workload profile (see definitions below)
    • [0180] Latency objectives and actions
    • [0181] features: compression, deduplication, encryption, etc.

[0182] Defines one or more of the following behaviors:

• • [0183] Latency target
  • [0184] Latency priority (vs cost)
  • [0185] Alarm if latency >x milliseconds for t time

• • [0186] Enable/Disable
  • [0187] Select Auto or specific pool
  • [0188] Protection (x0, x1, x2)
  • [0189] Cache Random Writes
  • [0190] Store files smaller than xKB in Flash
  • [0191] Cache Random Reads

• • [0192] Read ahead size
  • [0193] Delayed reads, queue size, max delay
  • [0194] Cache priority

• • [0195] Delayed writes, Min IOs to commit, Min Size to commit
  • [0196] space allocation (writes)
  • [0197] Default Block size

• • [0198] Snapshots: hourly, daily, monthly, target OSS per each, size/% limits per each
  • [0199] Disaster recovery attributes
  • [0200] Full/Partial backup schedule, destination OSS(s)
  • [0201] Sync and share (to a remote cloud service)
  • [0202] Data migration between storage repositories or tiers
  • [0203] Must not delete before date (WORM, Immutability)
  • [0204] Delete after n days (from create or last read, or last update) or after it was archived
  • [0205] Transformation, read through a set of objects matching the filters and generating a new transformation of data.
  • [0206] Search, look for certain content or metadata in a set of objects matching the filter

[0207] The Lifecycle policy can be executed based on incoming transactions, or at a given schedule, or right after certain system activities or events.

[0208] Monitor (Source Host/Net/User/Group+Protocol, Object path/type, Current Tags)

• • [0209] Counters/Charts: measure IO, Bandwidth, Opens, create, latency, cache-hits, random/seq statistics
  • [0210] Alarms: send notification when min/max/avg/sum of counter is >/</=X for at least N periods of T (time)
  • [0211] Activity logs (record of all operations, by operation filter)
  • [0212] Heatmaps per object, provide indication on seq/rand, r/w, data locality, cache hits
  • [0213] Reports can be stored as templates/dashboards or sent on scheduled event to user email

[0214] As previously described, policy can be enforced by multiple data processing services (DPS) in a global scale. Such enforcement may require replicating the policy and state of the data objects in all the relevant processing elements in a consistent way.

[0215] To enable better scaling and performance the data object processing may be scattered across multiple data processing services (DPS) where each such service may only process a portion of the data namespace, that is individual objects or containers or some portion of those, so that each service needs to only hold and manage a portion of the data management policy which is relevant to those objects. In such a case the front-end services (FES) need to know where to direct the traffic to, so only data management services that are synchronized on the policy and state of data objects process those data objects and the system maintains a consistent policy and data view.

[0216] Multiple data processing services in the same or different locations may manage the same data objects to enable greater performance or locality or availability or scalability. In such a case, the object state and/or policy and/or content may need to be replicated across all the services which may manage the same data.

[0217] A higher level controller entity can take the global policy and break and/or replicate the policy into multiple data processing services in different locations in a consistent way.

[0218] It is expected that during the life of a patent maturing from this application many relevant data management services and transactions will be developed and the scopes of the corresponding term are intended to include all such new technologies a priori.

[0219] The terms “comprises”, “comprising”, “includes”, “including”, “having” and their conjugates mean “including but not limited to”.

[0220] The term “consisting of” means “including and limited to”.

[0221] As used herein, the singular form “a”, “an” and “the” include plural references unless the context clearly dictates otherwise.

[0222] It is appreciated that certain features of the invention, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment, and the above description is to be construed as if this combination were explicitly written. Conversely, various features of the invention, which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable subcombination or as suitable in any other described embodiment of the invention, and the above description is to be construed as if these separate embodiments were explicitly written. Certain features described in the context of various embodiments are not to be considered essential features of those embodiments, unless the embodiment is inoperative without those elements.

[0223] Although the invention has been described in conjunction with specific embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, it is intended to embrace all such alternatives, modifications and variations that fall within the spirit and broad scope of the appended claims.

[0224] All publications, patents and patent applications mentioned in this specification are herein incorporated in their entirety by reference into the specification, to the same extent as if each individual publication, patent or patent application was specifically and individually indicated to be incorporated herein by reference. In addition, citation or identification of any reference in this application shall not be construed as an admission that such reference is available as prior art to the present invention. To the extent that section headings are used, they should not be construed as necessarily limiting.