Security and licensing with application aware storage

[0001] 1. Technical Field

[0002] This application generally relates to data storage, and more particularly to techniques used for security and licensing in connection with data storage.

[0003] 2. Description of Related Art

[0004] Computer systems may include different resources used by one or more host processors. Resources and host processors in a computer system may be interconnected by one or more communication connections. These resources may include, for example, data storage devices such as those included in the data storage systems manufactured by EMC Corporation. These data storage systems may be coupled to one or more servers or host processors and provide storage services to each host processor. Multiple data storage systems from one or more different vendors may be connected and may provide common data storage for one or more host processors in a computer system.

[0005] A host processor may perform a variety of data processing tasks and operations using the data storage system. For example, a host processor may perform basic system I/O operations in connection with data requests, such as data read and write operations.

[0006] Host processor systems may store and retrieve data using a storage device containing a plurality of host interface units, disk drives, and disk interface units. The host systems access the storage device through a plurality of channels provided therewith. Host systems provide data and access control information through the channels to the storage device and the storage device provides data to the host systems also through the channels. The host systems do not address the disk drives of the storage device directly, but rather, access what appears to the host systems as a plurality of logical disk units. The logical disk units may or may not correspond to the actual disk drives. Allowing multiple host systems to access the single storage device unit allows the host systems to share data in the device. In order to facilitate sharing of the data on the device, additional software on the data storage systems may also be used.

[0007] Different tasks may be performed in connection with a data storage system. For example, a customer may perform data storage configuration tasks. Such tasks may include configuring storage for use with an email application. In connection with the configuration processing, tasks may include allocating storage, specifying the logical and/or physical devices used for the storage allocation, specifying whether the data should be replicated, the particular RAID (Redundant Array of Independent or Inexpensive Disks) level, and the like. A customer may be required to perform each of the various configuration processing tasks including those about which the customer may not be knowledgeable and may result in adverse consequences, such as improper configuration.

[0008] Thus, it may be desirable to utilize a flexible technique which assists customers in connection with performing data storage services such as related to data storage configuration. It may be desirable that the technique be adaptable to complete the requested task in accordance with the different customer proficiency levels so that the level of control and the information provided by the customer varies with the customer's proficiency level. It may be desirable to vary the level of control and operations allowed in accordance with different security and licensing provisions for the different proficiency levels.

[0009] In accordance with one aspect of the invention is a method for processing a data storage configuration request for an application comprising: receiving, from a requester, the data storage configuration request; determining a first user level of a plurality of user levels at which said data storage configuration request is made by said requester, each of said plurality of user levels being associated with a different level of abstraction with respect to processing performed in the data storage system for implementing the data storage configuration request; and servicing said data storage configuration request, said servicing including determining whether to perform said data storage configuration request in accordance with security criteria defining, for each of said plurality of user levels, permitted operations that may be performed for different requesters in connection with said data storage configuration request. The security criteria may include an access control list specifying permitted operations that may be performed for one or more users. The security criteria may include an access control list specifying permitted operations for one or more defined user roles in accordance with a role-based security model. Each of the plurality of user levels may be associated with a different proficiency level of performing said data storage configuration request for the application. Information supplied in connection with said request by said requester when made at said first user level may be different than other information supplied in connection with said request when made at a different one of said plurality of user levels. The security criteria may include a first set of security criteria used by a first service provider at said first user level and a second set of security criteria used by a second service provider at a second of said plurality of user levels, and said servicing the data storage configuration request may further include: said first service provider making a first determination using said first security criteria whether to perform a first operation, said first security criteria specifying whether said first operation is a permitted operation that may be requested by said requester; performing a first call from the first service provider to the second service provider; and said second service provider making a second determination using second security criteria whether to perform a second operation, said second security criteria specifying whether said second operation is a permitted operation that may be requested by said first service provider. The security criteria may specify one or more permitted operations that may be requested indirectly by a first service provider at said first user level making a request for service from a second service provider at a different one of said plurality of user levels. The determining whether to perform said data storage configuration request may be performed in accordance with said security criteria and licensing provisions. The licensing provisions may define permissible operations in accordance with a license. The licensing provisions may identify one or more of said plurality of user levels at which a received request is permitted.

[0010] In accordance with another aspect of the request is a method for processing a data storage management request for an application comprising: receiving the data storage configuration request issued from a requester; determining a first level of a plurality of levels at which said data storage management request is made by said requester, each of said plurality of levels being associated with a different level of abstraction with respect to processing performed in the data storage system for implementing the data storage management request; and servicing said data storage management request, said servicing including: determining, by a first service provider of the first level, whether to perform a first operation on a first object in accordance with at least one of: first security criteria defined for the first object, a request type, and licensing provisions, wherein said security criteria specifies, for each of one or more requesters, allowable operations that may be requested by said each requester, and wherein said request type is one of a direct request type or a proxy request indicating that the first operation is being performed in response to a request from another service provider on behalf of said requester. The allowable operations may be specified for different user roles, one or more of said different user roles being associated with each requester of the data storage system. The data storage management request may be one of a data storage configuration request to configure data storage for the application hosting data on a data storage system or a data storage monitoring request, and the other service provider may be at a different one of said levels than said first service provider.

[0011] In accordance with another aspect of the invention is a data storage system comprising executable code stored on a computer readable medium for processing a data storage configuration request for one or more applications hosting data on the data storage system, the computer readable medium comprising, for each of said one or more applications, code for: providing a plurality of levels of service providers for processing requests, each of said plurality of levels being associated with a different level of proficiency in connection with performing data storage configuration operations on said data storage system for said each application, each of said service providers operating on one or more objects in connection with processing a request received by said each service provider; providing interfaces for issuing requests to said plurality of service providers, a first interface for a first one of said plurality of service providers at a first level being defined in accordance with a proficiency level associated with said first level, said first interface being used by a requester issuing the data storage configuration request to the first service provider when said requester is interacting with said data storage system at said first level, said first interface also being used by at least one other service provider when said other service provider issues a request that is a proxy request to said first service provider on behalf of said requester; providing security provisions in accordance with each of one or more levels of proficiency in connection with performing data storage configuration operations on said data storage system for said each application; and determining, by each of said plurality of service providers receiving a request, whether to perform an operation in connection with processing said request, said determining using at least a portion of said security provisions. The security provisions may include at least one provision indicating whether a first operation at said first level is allowable in connection with a proxy request from a requester. The determining may be performed using at least one licensing provision defining permissible operations in accordance with a license. The licensing provisions may identify one or more of said plurality of levels at which a requester may issue said data storage configuration request to said data storage system. The proxy request may be a request to perform a portion of processing steps in connection with servicing said data storage configuration request for said each application. The data storage system may further comprise code for: defining one or more user roles in accordance with each of said one or more levels of proficiency; assigning to each requester one or more of said user roles; and using said one or more roles in connection with specifying said security provisions to indicate which operations are allowable for different ones of said requesters at different ones of said plurality of levels. Each of the plurality of service providers may perform operations on objects and said security provisions are used in connection with determining whether an operation for one of said objects is allowable when said operation is performed as a result of processing a request received by said each service provider.

[0027] Referring to FIG. 1, shown is an example of an embodiment of a computer system that may be used in connection with performing the techniques described herein. The computer system 10 includes one or more data storage systems 12 connected to server or host systems 14a-14n through communication medium 18. The system 10 also includes a management system 16 connected to one or more data storage systems 12 through communication medium 20. In this embodiment of the computer system 10, the management system 16, and the N servers or hosts 14a-14n may access the data storage systems 12, for example, in performing input/output (I/O) operations, data requests, and other operations. The communication medium 18 may be any one or more of a variety of networks or other type of communication connections as known to those skilled in the art. Each of the communication mediums 18 and 20 may be a network connection, bus, and/or other type of data link, such as a hardwire or other connections known in the art. For example, the communication medium 18 may be the Internet, an intranet, network or other wireless or other hardwired connection(s) by which the host systems 14a-14n may access and communicate with the data storage systems 12, and may also communicate with other components (not shown) that may be included in the computer system 10. In one embodiment, the communication medium 20 may be a LAN connection and the communication medium 18 may be an iSCSI or fibre channel connection.

[0028] Each of the host systems 14a-14n and the data storage systems 12 included in the computer system 10 may be connected to the communication medium 18 by any one of a variety of connections as may be provided and supported in accordance with the type of communication medium 18. Similarly, the management system 16 may be connected to the communication medium 20 by any one of variety of connections in accordance with the type of communication medium 20. The processors included in the host computer systems 14a-14n and management system 16 may be any one of a variety of proprietary or commercially available single or multi-processor system, such as an Intel-based processor, or other type of commercially available processor able to support traffic in accordance with each particular embodiment and application.

[0029] It should be noted that the particular examples of the hardware and software that may be included in the data storage systems 12 are described herein in more detail, and may vary with each particular embodiment. Each of the host computers 14a-14n, the management system 16 and data storage systems may all be located at the same physical site, or, alternatively, may also be located in different physical locations. In connection with communication mediums 18 and 20, a variety of different communication protocols may be used such as SCSI, Fibre Channel, iSCSI, and the like. Some or all of the connections by which the hosts, management system, and data storage system may be connected to their respective communication medium may pass through other communication devices, such as a Connectrix or other switching equipment that may exist such as a phone line, a repeater, a multiplexer or even a satellite. In one embodiment, the hosts may communicate with the data storage systems over an iSCSI or a Fibre Channel connection and the management system may communicate with the data storage systems over a separate network connection using TCP/IP. It should be noted that although FIG. 1 illustrates communications between the hosts and data storage systems being over a first connection, and communications between the management system and the data storage systems being over a second different connection, an embodiment may also use the same connection. The particular type and number of connections may vary in accordance with particulars of each embodiment.

[0030] Each of the host computer systems may perform different types of data operations in accordance with different types of tasks. In the embodiment of FIG. 1, any one of the host computers 14a-14n may issue a data request to the data storage systems 12 to perform a data operation. For example, an application executing on one of the host computers 14a-14n may perform a read or write operation resulting in one or more data requests to the data storage systems 12.

[0031] The management system 16 may be used in connection with management of the data storage systems 12. The management system 16 may include hardware and/or software components. The management system 16 may include one or more computer processors connected to one or more I/O devices such as, for example, a display or other output device, and an input device such as, for example, a keyboard, mouse, and the like. A data storage system manager may, for example, view information about a current storage volume configuration on a display device of the management system 16, provision data storage system resources, and the like.

[0032] In one embodiment, the one or more data storage systems 12 of FIG. 1 may be an appliance with hardware and software for hosting the data storage of the one or more applications executing on the hosts 14a-14n. The appliance may include one or more storage processors and one or more devices upon which data is stored. The appliance may include software used in connection with storing the data of the hosts on the appliance and also software used in connection with configuring the data storage for use by the hosts in connection with techniques described herein. As an example in connection with an email application server component that may executed on the hosts 14a-14n, the data storage configuration tasks may include allocating storage for user accounts or mailboxes, specifying the devices (logical and/or physical) used to store the email data, specifying whether data replication is performed for disaster recovery, and the like. Techniques that may be used in connection with performing data storage configuration and configuration tasks are described in more detail in following paragraphs in order to provide ease of use to customers of the data storage system(s) 12.

[0033] In connection with an embodiment in which the data storage 12 is an appliance including hardware and software, the appliance may also include other software for performing different data services. For example, the appliance may include backup server software which interacts with software on the hosts 14a-14n when performing a backup operation.

[0034] In another embodiment, the data storage systems 12 may include one or more data storage systems such as one or more of the data storage systems offered by EMC Corporation of Hopkinton, Mass. Each of the data storage systems may include one or more data storage devices, such as disks. One or more data storage systems may be manufactured by one or more different vendors. Each of the data storage systems included in 12 may be inter-connected (not shown). Additionally, the data storage systems may also be connected to the host systems through any one or more communication connections that may vary with each particular embodiment and device in accordance with the different protocols used in a particular embodiment. The type of communication connection used may vary with certain system parameters and requirements, such as those related to bandwidth and throughput required in accordance with a rate of I/O requests as may be issued by the host computer systems, for example, to the data storage systems 12. It should be noted that each of the data storage systems may operate stand-alone, or may also be included as part of a storage area network (SAN) that includes, for example, other components such as other data storage systems. Each of the data storage systems may include a plurality of disk devices or volumes. The particular data storage systems and examples as described herein for purposes of illustration should not be construed as a limitation. Other types of commercially available data storage systems, as well as processors and hardware controlling access to these particular devices, may also be included in an embodiment.

[0035] In such an embodiment in which element 12 of FIG. 1 is implemented using one or more data storage systems, each of the data storage systems may include code thereon for performing the techniques as described herein for processing a data storage configuration request.

[0036] Servers or host systems, such as 14a-14n, provide data and access control information through channels to the storage systems, and the storage systems may also provide data to the host systems also through the channels. The host systems may not address the disk drives of the storage systems directly, but rather access to data may be provided to one or more host systems from what the host systems view as a plurality of logical devices or logical volumes (LVs). The LVs may or may not correspond to the actual disk drives. For example, one or more LVs may reside on a single physical disk drive. Data in a single storage system may be accessed by multiple hosts allowing the hosts to share the data residing therein. An LV or LUN (logical unit number) may be used to refer to the foregoing logically defined devices or volumes.

[0037] In following paragraphs, reference may be made to a particular embodiment such as, for example, an embodiment in which element 12 of FIG. 1 is an appliance as described above. However, it will be appreciated by those skilled in the art that this is for purposes of illustration and should not be construed as a limitation of the techniques herein.

[0038] Described in following paragraphs are techniques that may be used to assist customers of a data storage system in connection with performing data storage services such as related to data storage system configuration, provisioning of data storage, and the like. The techniques herein are adaptable to the particular knowledge level of the user. The techniques are flexible and allow for implementation of best practices and defaults in an automated fashion which are customized for the particular application, user or customer, and/or underlying data storage system and environment to meet specific customer needs. As will be described in more detail, depending on the level at which a user interacts with the data storage system, different levels or amounts of automation of the best practices may be performed. The user may elect to bypass the automation of best practices or limit the amount of automation performed by interacting with the system at various levels.

[0039] Referring to FIG. 2, shown is an example representation of components that may be included on the data storage system 12 for use in performing the techniques herein for data storage configuration. The example 100 includes a user interface 102, one or more levels of service providers 110, and adapters 106. In the example 100, the element 110 includes 3 service provider layers or levels 104a-104c. It should be noted that although 3 service provider levels are shown in FIG. 2, an embodiment may include any number of service provider levels.

[0040] The adapters 106 are used in connection with facilitating communications between the service providers, such as the level 3 service provider 104c, and other components. The different service providers included in the example 100 may be able to communicate directly with one another. However, when one of the service providers at one of the levels communicates with another component other than one of the service providers, an adapter may be utilized. An adapter may be characterized as a layer of software between one of the service providers, such as service provider 104c, and another component, such as a lower-level component invoked to implement data storage platform specific functionality. An adapter 106 may convert a service provider API to the API of another component. As an example, the service provider 104c may perform a call to an external component to create a file system. An adapter 106 may be used as an intervening layer between 104c and the external component in which the adapter 106 converts the API call from 104c to the API of the external component. The conversion may include, for example, mapping parameters between the API calls, performing multiple calls to the external component for the one API call from 104c, and the like. It should be noted that an adapter 106 may not utilized if such conversion is not needed.

[0041] The user interface (UI) 102 provides for one or more different types of user interfaces and associated data. For example, the UI 102 may provide support for a graphical user interface (GUI), command line interface (CLI), and the like, to support interactions between the data storage system 12 and the hosts 14a-14n of FIG. 1. Each of the different service provider levels of 110 may provide a different logical view and level of abstraction with respect to a data storage configuration task to be performed for an application executing on one of the hosts. In connection with the techniques herein, a user may interact through the UI 102 with any one of the different levels of service providers 104a-104c when performing data storage configuration requests. Each of the service providers of 110 may provide a different level of detail or abstraction with respect to the underlying operations and tasks performed on the data storage system in accordance with different levels of user sophistication and knowledge. As will be described in more detail below, the language or terminology, UI data (e.g., content or data used to populate the UI menus), and UI presentation or structure (e.g., commands presented or particular hierarchical menu structure) may vary in accordance with the particular level of service provider selected by the user. Thus, a user may interact with the data storage system at a variety of different levels when issuing data storage configuration requests for the same application. The UI may be customized for the particular level and application for which the request is performed.

[0042] In an embodiment, the UI 102 may be characterized a set of different user interfaces that may vary depending on the target user and associated user level at which the user interacts with the system. As described in more detail in following paragraphs, each level may provide a different user interface for a different level of user interaction and level of knowledge and sophistication. Each level may also be associated with a different level of automation of the best practices, for example, with users interacting at level 1 obtaining the greatest amount of automation of best practices and users interacting at level 3 obtaining none or minimal amount of automation. The UI 102 may provide multiple different user interfaces in accordance with the different levels allowing a user the option of connecting and interacting with the data storage system at any level. By allowing a user to select a level of interaction and automation, the techniques herein provide a user with a flexible approach to choose deeper levels and entry points (e.g., level 3) providing less automation and more detail as well as selection of other levels (e.g., level 1) when greater automation of best practices is desirable.

[0043] For example, level 1 service provider 104a may provide a beginner or most simplistic view of the data storage system and tasks performed for data storage configuration. Interaction with the level 1 service provider 104a requires the least amount of knowledge and may be geared toward interacting with users having minimal knowledge when performing a data storage configuration request by providing the greatest level of abstraction of the underlying system and operations performed. The language may be more non-technical in comparison to the interface language of other levels. As the level increases, so does the assumed level of knowledge of the user in connection with interactions. Level 3 service provider in the example 100 may be utilized by the most knowledgeable users providing a greatest granularity of control of all levels in connection with a data configuration request. Level 3 exposes more detailed information to the user than interactions at levels 1 and 2. As an example, a level 1 user may issue a data storage configuration request to provision storage for a number of mailboxes for storing data of an email application executing on one of the hosts. The level 1 user may specify a minimal amount of information in connection with the request such as only a number of mailboxes. A user may interface with the data storage system using a GUI and issue the data storage configuration request. The language and terminology of user interactions via the GUI may be customized for the level 1 user of the email application. In connection with the same email application, a more knowledgeable user may choose to issue a data storage configuration request via a GUI for a same number of mailboxes by interacting with level 3 service 104c. At level 3, the user provides more detailed information about the request regarding the underlying data storage device and how this data storage device is used by the application. To further illustrate, the level 3 data storage configuration request may specify the physical and/or logical devices upon which storage is allocated, provide vendor-specific attributes or settings, indicate a number and type of file created, and the like. In connection with the type of file created, this may be particular to the email application. A file may be a database or a log file. The log files are used to keep a record of transactions taking place and may be used in connection with recovery operations. The database files hold mailbox stores such as email data. In connection with the user communicating with the level 1 service provider, such detail is not provided and defaults may be specified by the data storage system when implementing the level 1 data storage configuration request. The defaults may be customized for the particular application.

[0044] When implementing the request, the level 1 service provider may communicate with one or more other level service providers such as 104b and 104c. Different defaults for the particular application may be used by service providers 104b and 104c. For example with reference to the level 1 request for the email application described above, the level 1 service provider 104a may communicate with the level 2 service provider 104b. Provider 104b may then communicate with the level 3 service provider 104c to implement the request and allocate the requested storage along with specifying other defaults such as, for example, a default level of data protection. The service provider 104c may communicate with other data storage system hardware and/or software when implementing the configuration request.

[0045] As illustrated in the example 100, a service provider at a level n may generally communicate, directly or indirectly, with one or more other service providers at levels lower than level n when processing a data storage configuration request. A user may select the level of interaction and the user's data configuration request is received at the data storage system by the UI 102. The UI 102 in turn communicates with the appropriate level service provider to initiate the request. Furthermore, a request received at a first level can result in multiple requests to a lower level to perform an operation. For example, a user may connect to the data storage system 12 at level 1 104a. In response, the level 1 service provider 104a may issue more than one request to provider 104b. In turn, each request to provider 104b may result in one or more requests to provider 104c which, in turn, communicates with adapters and other code modules to perform the requested operation.

[0046] The data storage configuration request may identify the user (e.g., by user identifier or other authentication information), the application for which the request is being made, and any user selections or input parameters.

[0047] In one embodiment, the service providers 104a-104c may be code modules which are included in the same appliance. Each of the service providers 104a-104c may provide a published interface or API (application programming interface). A first service provider at level n may issue a request of another lower level service provider by issuing an API call to the lower level service provider. The API may also be used to facilitate communications between the UI 102 and the different level service providers of 110. As described in more detail in following paragraphs, an API call from a first service provider to a second service provide may use rules or mappings to map the data received by the first service provider to the appropriate API call with parameters and any defaults in accordance with the received data. Thus, the rules or mappings may be used to map between levels of abstractions of the different service providers.

[0048] Although an embodiment may have all service providers 110 located in the same appliance or other component, the service providers may be characterized as remotable. One or more of the service providers may be located on different components having connectivity so that the API calls between service providers may be remote API calls as well as local API calls (e.g., service providers on same component). As an example, an embodiment may have multiple data storage systems included in a network. Each of the service provider may be located on a different data storage system.

[0049] An embodiment may determine the level at which a user interacts with the system using a variety of different techniques. With reference to FIG. 2, a user may be allowed to interact at any of the 3 levels. The menus may be directed to a level 1 user. The user may select whether to interact at a lower level by selecting further detailed menu options providing more detailed information at lower levels. As a variation, a user may have associated roles or permissions. If the user does not have the associated roles or permissions to perform operations or view such detailed information associated with particular levels, the associated menu options, wizards, and the like, may not be displayed or may otherwise be disabled when interacting with the particular user.

[0050] As a variation to the foregoing, the levels exposed to a user may be limited in that a user may not be allowed to interact with one or more lower levels. For example, user interaction with the data storage system may start at level 1 and provide wizard or other menu options for more detailed selection by the user for level 2. However, information and interactions at level 3 may never be exposed if the product is intended only for a certain level of users or a particular target market. In other words, the capability to drill down and interact may be limited to only levels 1 and 2 but not level 3.

[0051] An embodiment may also utilize user preferences to determine the initial or default level of interaction and exposure. For example, user preference settings stored on the data storage system or on the host may specify a default level used for the user interface menus, language, and the like. No further detailed buttons or drill down capabilities may be provided via the interface unless the user changes his/her preferences and selects to apply such preferences. In such an embodiment, the user interface may be presented from a viewpoint of the user preferences having content, structure and an interface language/terminology in accordance with the selected level. The user preferences may be stored as configurable parameters or options on the appliance or remotely located, such as on the host, and used by the appliance. For example, the configuration file for the users may be stored on the host. An agent on the host may read the configuration file and communicate the preferences to software on the appliance providing data for populating and presenting the user interface. A user may change the preferences via menu options, directly editing a configuration file, and the like. As a user gains experience and knowledge, a user may select to interact at a lower level for some or all requests.

[0052] Referring to FIG. 3, shown is another example representation of components that may be included on the data storage system 12 for use in performing the techniques herein for data storage configuration. The example 200 is a more detailed illustration setting forth a particular instance of the different service providers and levels that may be included in an embodiment. Elements 202 and 206 are similar, respectively, to elements 102 and 106. Element 210 includes 3 service providers: application service provider 204a, intermediate or generic storage service provider 204b and physical storage service provider 204c. With respect to a level hierarchy, 204a may correspond to level 1 service provider 104a of FIG. 2, 204b may correspond to level 2 service provider 104b of FIG. 2, and 204c may correspond to level 3 service provider 104c of FIG. 2.

[0053] The application service provider 204a may have an application-specific focus and provide a level of abstraction customized for an application such as, for example, a particular email application, law office application or medical office application, as well as a class of related applications, such as a multiple email applications. When interacting with provider 204a for a particular application, the interface language may vary with the application. For example, if the application is a law office application, the interface language, menu options, and the like, may be tailored to the law profession. Similarly, a medical office application may utilize an interface language, menu options, and the like, familiar to the medical office. As such, the application service provider 204a may use one set of rules or mappings for each application to implement the application specific best practices for the user level. A first set of rules for the medical office application may be used to map the user input parameters using medical office terminology to parameters for the appropriate API calls for other service providers 204b and/or 204c. A second set of rules for the law office application may be used to map the user input parameters using law office terminology to parameters for the appropriate API calls for other service providers 204b and/or 204c. The user connecting to the data storage system at the application service provider level 204a may be provided with a user interface customized for the selected level and application to perform a requested data storage configuration.

[0054] The intermediate storage service provider 204b may be an intermediate or second level of user interaction. As illustrated, the provider 204a may communicate with 204b when implementing a request for data storage configuration. In one embodiment, a user connecting to provider 204b may be provided with a generic level of interaction which may not be tailored for the particular application. In other words, the same language and user interface may be presented to a user for multiple applications such as the medical application or law office application. As a variation to the foregoing, the service provider 204b may be customized for each application and provide for a more detailed level of exposure that varies per application.

[0055] The physical storage service provider 204c provides the most detailed or greatest level of exposure of the underlying data storage system. The provider 204c may be customized for the particular storage vendor and associated options. The user interface for a user connected at level 3 to service provider 204c may include menu options and terms particular to the underlying storage vendor and the more knowledgeable user. For example, the user may specify particular devices, RAID levels and techniques, file types, SCSI and iSCSI terminology, and the like.

[0056] The best practices and the automation of the best practices as described in more detail in following paragraphs may be customized for a particular application and the particular data storage system and environment. In other words, the best practices may vary in accordance with the particular application as well as the underlying data storage system and environment. For example, different practices may be preferred for a same application as the underlying data storage system changes. In such an instance, for example, there may be a first set of mappings used for mapping level 204a information to level 204b providing automation of best practices for a user connecting at level 204a for the application. The same first set of mappings may be used even if the data storage system differs. Other mapping rules may be used to map level 204b information to level 204c information in accordance with the best practices for the underlying data storage system. As the data storage system changes, the mappings used for level 204b-level 204c mapping may change although the same first set of mappings may be used.

[0057] Referring to FIG. 4, shown is an example illustrating how the different service providers of FIG. 3 may be used to perform the mapping between levels to perform a data configuration request, and also provide different levels of user interaction.

[0058] Elements 204a, 204b, and 204c correspond to the different levels of service providers described in connection with FIG. 3. Elements 310, 312 and 314 represent the information obtained via the UI at the various levels and service providers. Element 310 represents the information obtained for a user connected at level 1 to service provider 204a. Element 312 represents the information obtained for a user connected at level 2 to service provider 204b. Element 314 represents the information obtained for a user connected at level 3 to service provider 204c. Information obtained by a user at level n may be subsequently passed on via an API call to one or more other lower level (e.g. greater than n) service providers in order to perform the user request.

[0059] Element 312 may also represent the information communicated by the service provider 204a after the provider 204a applies mapping rules 302b to 310 resulting in an API call of the form as illustrated in 312. Element 314 may represent the information communicated by the service provider 204b after the service provider 204b applies mapping rules 304b to 312 resulting in an API call of the form as in 314

[0060] With reference to the example 300, if a user interacts with the system at level 1, the application service provider 204a obtains the data included in 310 which is passed on in form 312 to provider 204b as illustrated by 316. Provider 204b in turn maps data from form 312 to the form of 314 to provider 204c as illustrated by 318. If a user interacts with the system at level 2, the intermediate service provider 204b obtains the data included in 312 and passes the data of 312 to provider 204c in the form represented in 314. If a user interacts with the system at level 3, the physical storage service provider 204c obtains the data from the UI in the form 314. In this example, the provider 204c may implement or execute the one or more operations to perform the request indicated by 314 by invoking one or more other code modules 320. The code modules 320 may communicate with other components on the data storage system to perform the requested task.

[0061] In one embodiment, the UI 202 of FIG. 3 may query each service provider to obtain the appropriate UI data 302a, 304a and 306a via API calls in accordance with a user selected level of interaction using any one of a variety of different techniques as described herein and known to those skilled in the art. The UI data 302a, 304a and 306a may be used to populate the menus and other UI elements that may be displayed to a user.

[0062] The example 300 illustrates the user inputs for creating a file system for an application with interactions at the various levels 1-3. Element 310 illustrates the input received from the most basic user level 1 in which the user may enter a command to create a particular files system. The file system created with user level 1 interactions uses all default options specified via mapping rules and API calls to levels 2 and 3. For level 2, the parameters input from the user or received via mapping and an API call from level 1 are illustrated in 312. By default, parameters related to size (e.g., SIZE=size), device speed, (e.g., QOS=FAST, wherein QOS is “quality of service”) and data protection (e.g., REDUNDANT) are specified. At level 2, there is a level of abstraction from the underlying data storage system but the attribute characteristics may be specified. For level 3, the parameters input from the user or received via mapping and an API call from level 2 are illustrated in 314. At level 3, details regarding the underlying data storage system, such as devices, RAID levels, vendor-specific attributes, which file system (e.g., NFS, CIFS) or block storage, and the like, are specified. For example, level 2 indicates that storage for the file system is to be located on a FAST device. Level 3 mapping rules map the abstract FAST attribute to the particular device (e.g., LUN(s) on the data storage system that may be characterized as FAST with respect to other data storage devices). As more physical devices and/or logical devices added which are also FAST, different LUNs may be used and specified by the mapping rules 304a without any change in the data of 312. Thus, data obtained from users interacting at level 1 and 2 need not change as the underlying data storage system changes when devices are added/removed.

[0063] In connection with the bottom most level service provider 204c or service provider associated with the greatest level of user knowledge and detail, 204c may optionally not include and utilize rules 306b. An embodiment may have the language of the user interface map directly with low level calls to code modules to implement the request. In other words, the language terms and parameter values specified by the user at level 3 may not require mapping in order to be utilized by the system.

[0064] As will be appreciated by those skilled in the art, the examples, such as those of FIG. 4 and following, may be simplistic for purposes of illustration of the techniques herein. At lower levels, there may be greater amounts of detail and complexity in order to provide automation of the best practices.

[0065] Referring to FIG. 5, shown is another representation of the mapping of the different parameters that may be performed by the rules of the different service providers. The example 400 further illustrates the parameter mapping between levels. Element 402 represents the data obtained by service provider 204a. Element 404 represents the data obtained by service provider 204b via direct user interaction or from provider 204a. Element 406 represents the data obtain by service provider 204c via direct user interaction or from provider 204b. The FILESYSTEM type is passed 410a as a parameter from level 1 to level 2, and then passed to level 3 410b. Level 1 mapping rules may define defaults based on best practices for the particular application as indicated by the parameters SIZE=size, specifying a default size for the file system, and QOS=FAST, REDUNDANT, specifying default quality of service (QOS) parameters for a fast device with redundancy. Level 2 mapping rules map the parameters of 404 to parameters of 406 as indicated by 410c, 410d and 410e. Additionally, level 2 mapping rules introduce additional default parameter values as indicated by element 408 when interacting with level 3.

[0066] As described herein, the user can connect and interact with the data storage system at various levels to perform data configuration requests. The user may select the level of interaction that can vary with each request. The mapping rules provide for specifying any defaults that may be needed to implement the request. When implementing a same data configuration request for different applications, the defaults introduced at one or more levels may vary with application. The mapping rules at the different levels allow for implementation of best practices while insulating and abstracting the details from the user. For example, the rules used by the application service provider of FIG. 3 may be used to implement application specific best practices. The rules used by the intermediate storage service provider may be used to implement best practices with respect to the underlying data storage system. As such, using the techniques herein, a framework may be defined which provides customized interfaces for different user levels of interaction with respect to a particular application when performing a data service for data storage configuration for the particular application. Rules included in the framework may be selected for use depending on the application, data service, and defined set of one or more user groupings. A user grouping may be defined as a set of one or more user levels and associated service providers. For example, FIG. 3 illustrates a single user grouping of 3 levels with associated service providers 204a, 204b and 204c. A data service may be defined as a particular service performed in connection with a data storage configuration request. Example data services are provided elsewhere herein.

[0067] Referring to FIG. 6, shown is a function that may be used to select a particular rule set. The example 500 illustrates a 3-dimension mathematical function, F, in 502 representing in a parameterized form a function that may be used in connection with selecting a rule set. As described in more detail elsewhere herein, a rule set may be defined as a set of rules or mappings used by the different service provider levels for a specified user grouping. Element 504 indicates the user grouping defined in the example of FIG. 3 having 3 user groups or levels. For purposes of illustrating the 3-dimensional function, the first dimension, the user grouping, has a value as indicated by the user grouping 1 of 504. The rule sets available for selection with the user grouping 504 are illustrated by element 502. Element 520 is a matrix of specified rule sets from which one is selected for a particular set of values for the function F of 502. Other 2 dimensional matrices may be defined for different user groupings. The matrix 520 uses a row index to indicate the rule sets for use with a particular data service 512 and a column index to indicate the rule sets for use with a particular application 510. Generally, data services may include any service that transforms or utilizes the data and/or the storage of the data. Exemplary data services include storage capacity/provisioning, disaster recovery, data protection, and hierarchical storage management. Storage capacity/provisioning data service may include operations to allocate storage. A data configuration request, such as a request to create a file system described elsewhere herein, may be provided by the storage capacity/provisioning data service 512a. The disaster recovery data service may perform services to plan for possible drive failures. Disaster recovery services may include, for example, data replication. Data protection services may include, for example, providing data backups, encryption services, and the like. Hierarchical storage management services may provide services for managing the storage devices. Hierarchical storage management services may include, for example, moving data between different types of data storage devices such as between a fibre-channel data storage disk and an ATA (Advanced Technology Attachment) disk, between one of the foregoing disks and a tape, and the like. Other examples of services that may be included in an embodiment are retention services which focus on preventing deleting data until a certain time period and/or automated deletion of data after a specified time period, and classification services which may index content as stored to allow for other operations such as retrieval of content based on subsequent search criteria, categorization of data content, and the like. Example application of 510 may include an email application, a database application, and a banking application as well as the law office application and medical office application described elsewhere herein. It should be noted that a same rule set may be specified for more than one entry in the matrix. An entry in the matrix may not specify a rule set indicating that the particular combination of application and data service for the user grouping (e.g., parameters of F) is not supported. Other data services, as a category or included in a broader data service category, may provide for snapshots, cloning, migration, recovery, and the like.

[0068] It should be noted that application 510 can refer to a particular application category including one or more applications. For example, a column of 510 may refer to email applications as a category including multiple email applications from different vendors. However, a column of 510 may also be associated with a particular instance of an email application, such as Microsoft Exchange.

[0069] It will be appreciated by those skilled in the art that the number of dimensions of the function may vary from what is illustrated in FIG. 6. For example, if there is only a single user grouping for a set of applications and associated data services, then a 2-dimension or 2 parameter function may be used. Additionally, as illustrated in more detail in following paragraphs, the number of dimensions or parameters for the function may be more than 3.

[0070] Referring to FIG. 6A, shown is an example of a rule set for two applications. The example 550 includes a rule set 552 and another rule set 554. Each of the rule sets may be identified by an identifier in one entry of the matrix 520 of FIG. 6. The rule set 552 comprises rules used by each level service provider. For example, 552 includes level 1 rules 558 and level 2 rules, as well as other rules used by other level service providers. Rule set 554 includes level 1 rules 560 and level 2 rules. In this example, the level 1 rules of the two rule sets 552 and 554 may be different. However, the level 2 rules may be the same for both rule sets as indicated by 556. As an example described elsewhere herein with respect to the medical office application and the law office application in an embodiment having 3 user levels, a different set of level 1 rules may be used to map the different language and terminology of the user interface for each application and a same set of rules may be used to perform the level 2 to level 3 mapping. In such case, one entry in a matrix similar to 520 corresponding to the medical application may specify a rule set represented by 552 and another entry in the matrix corresponding to the law office application may specify a rule set represented by 554.

[0071] Referring to FIG. 7, shown is a data flow diagram of processing that may be performed by components in accordance with the techniques herein. In the example 600, the rule set determination process 604 selects a rule set from one of the rule set matrices 602 based on the selector inputs 620. With reference to FIG. 6, the selector inputs 620 may indicate values for the parameters of the function F. Based on the particular parameter values, the rule set 610 is selected and used by the rule engine 606. The element 610 may identify the particular rule set as illustrated in FIG. 6A specifying the mapping rules used by the different levels of service providers for the user grouping instance included in 620. Based on 610, the rules engine 606 retrieves the rules used in the mappings from the data store 608. Each service provider may include one or more of the rules engines 606 to perform the mappings using rules for the level of the service provider. A rules engine may invoke one or more other code modules 622, such as an API of another service provider, once a rule has been applied.

[0072] It should be noted that elements 602 and 608 may represent a data store, such as a file or memory location, at which the matrices and rules, respectively, are stored.

[0073] In connection with the rule set determination processing 604, the selector inputs 620 used to select the rule set may be determined, in whole or in part, implicitly, based on the user selections and user input parameters. For example a user may select a menu option to perform a requested task such as provision storage for use with mailboxes for an email application. Thus, the “application” parameter can be determined for the function F of FIG. 6. Based on the requested task, the particular “data service” may be determined. There may be one user grouping of 3 user levels defined for the “application” and “data service” instances so the rule set may be selected. The user may input one or more parameters via a GUI. Based on the one or more parameters, the user level of interaction may be determined. For example, user level 1 may be the only level to have a single parameter. If only a single input parameter is received from the user, it may be determined implicitly by the UI to interact with the level 1 service.

[0074] At a later point, the user may navigate to a different menu level and issue a different data storage configuration request. Accordingly, a different rule set may be determined.

[0075] It should be noted that each instance of a data service and application may have a different number of user levels and associated service providers. For example, a first data service for an application may have 3 levels and a second data service for the same application may have 5 levels or 2 levels. Furthermore, in connection with implementing a request for a first data service, one or more calls may be made at different levels to other data services. For example, a user level 1 request to perform a storage capacity data service operation may use rule set 1 to perform a first call to the data protection service (e.g., backup) which uses rule set 7.

[0076] Referring to FIG. 8, shown is a more detailed representation of the mapping rules as may be utilized in an embodiment. The example 700 is a further illustration of the example described in connection with FIGS. 4 and 5. The rule set 710 illustrates rules 712 used for the level 1 to level 2 (application service provider to intermediate storage service provider) mapping and the rules 714 used for the level 2 to level 3 (intermediate storage service provider) mapping. In connection with the description of FIG. 8, reference is made to the elements of FIG. 5.

[0077] The rules 712 indicate that the data of 702 is mapped to the data of 704. Elements 702 and 704, respectively, represent the data from 402 and 404 of FIG. 5. Element 704 indicates that the service to be invoked is the “intermediate storage” service provides using the API “Create” with the parameters indicated. The rules 714 indicate that the data of 706 is mapped to the data of 708. Elements 706 and 708, respectively, represent the data from 404 and 406 of FIG. 5. Element 708 indicates that the service to be invoked is the “physical storage” service provides using the API “Create” with the parameters indicated. Lines 730 indicate the particular parameter mapping and portions of the rule used for the mapping. In connection with 720 for determining the QOS parameters, the rule may include conditional statements and other language elements for implementing the rules. The particular language syntax may be parsed by the rules engine in connection with performing the mapping as described herein. The rules may be evaluated at runtime so that the rule language elements may use variables, expressions, statements, and the like, which can be evaluated at runtime in accordance with the user inputs, values specified by a calling service provider, variables indicated a current state of the data storage system, and the like. In this example 700, the element 720 includes statements which may be conditionally evaluated to determine the particular one or more QOS parameters passed in the call to the physical storage service provider. The variable QOS represents a list of parameter values. The example 720 includes 3 if statements which are evaluated based on particular values specified for the first QOS parameter, p1, and the second QOS parameter, p2. For example, if the QOS parameters have values as indicated in 404 of FIG. 5, the first if statement 720a evaluates to true and “fast device” is specified as one of the QOS parameters in the level 2-level 3 call. The second if statement 720b evaluates to false. The statement 720c evaluates to true and “RAID information” (e.g., such as RAID level, RAID devices used, etc.) is added to the QOS parameters in the level 2-level 3 call. Element 732 indicates additional default parameter values specified in the level 2-level 3 call.

[0078] In connection with the rules, a policy may be used to determine one or more default values. For example, in connection with provisioning storage for a level 1a user request, the lower level mapping rules may specify a particular default LUN set used until those LUNs reaches a certain capacity and then a different LUN set may be used. The parameter values in the rules representing the particular LUNs may be modified during operation of the system. The LUN set and the capacity may be included in a policy. The rules may include expressions for runtime evaluation of the amount of consumed storage on the specified LUN set and may use alternately specified LUN sets depending on the consumed capacity. Another way this may be implemented is to have the rules specify a dynamic parameter having a value which is determined at runtime such as by having the rules engine obtain a dynamic parameter value at a current point in time during operation of the data storage system. The dynamic parameter values may be updated by other software which performs monitoring or some other function in accordance with determining the particular parameter.

[0079] As a further example illustrating use of the techniques herein, different QOS parameters may be provided as defaults using the rule sets for the same application. Different rule sets may be specified depending on the particular usage, user grouping(s), and the like, for the same application. For example, the same application may be used to provide services to two different groups of users to create a file system. With reference to FIGS. 5 and 8, both user groups may enter a command as in 702. However, the default mapping rules such as illustrated by 704 may vary with each user group. For example, a first set of rules used for a first group may create the file system on a FAST device with REDUNDANT storage as illustrated in 404 of FIG. 5. However, a second set of rules used for the second user group may create the file system on a SLOW device without providing REDUNDANT storage. Thus the rules used for the second group may be represented as:

[0080] FILESYSTEM, SIZE=size, QOS=SLOW, NO REDUNDANCY

rather than as illustrated in 404 of FIG. 5. The rules may be used to customize the default QOS parameters and others for the same application depending on the particular usage and/or user group.

[0081] As illustrated herein, the techniques provide for use of rules processed by the rules engine. The rules are associated with a particular application and requirements or needs of the application as well as the particular storage capabilities of the underlying data storage system. Thus, an application's requirements may be mapped to the particular underlying data storage system capabilities using the rules. For example, 704 and 706 of FIG. 8 may represent the particular needs of the application for the usage. The application needs or requirements are mapped using the rules to the underlying data storage system capabilities such as, for example, represented in 708. Thus, the rules may be characterized as representing a configuration profile of the application for the particular usage on the data storage system.

[0082] Referring to FIG. 9, shown is an illustration in more detail of rules that may be used in connection with the medical office application and the law office application as described elsewhere herein. As described above in connection with these two applications, mappings used by 204a of FIG. 3 may implement application best practices and mappings used by provider 204b may be the same for two applications The rules used by 204a may specify different mappings for the different user interface language terms. The medical office application and the law office application may each have a different set of terms for the UI language at level 1. Both applications may perform the same data storage configuration request to create a files system but the customers of each application may be in the different market segments, each market segment using different terminology. For example, a medical office may refer to a customer as a patient and the law office refers to its customer as a client. Requests may be made for both applications to create a file system of a particular size based on parameters particular to each application. Thus, the UI data provided by 204a for the medical office application for presentation to a user is different than the UI data provided by 204a for the law office application.

[0083] The example 800 includes user interface data 802 for the law office application 806 and the medical office application 808. The elements 806 and 808 may each represent the user input for a user request. As illustrated, both are requests to create a file system. In connection with the request 806, the size of the file system is determined based on the number of clients (100) and particular areas of law for which client data will be stored in the file system. The user request is provisioning storage for 100 clients, 60 of which are real estate and 40 of which are patent clients. In connection with the request 808, the size of the file system is determined based on the number of clients (100). Element 804 includes rules 810 and 812. Rule 810 is used for the level 1 to level 2 mapping for the law office application. Rule 812 is used for the level 1 to level 2 mapping for the medical office application. In 810, the total size of the file system is determined using a first size, defaultsize1, for each real estate client record to be stored in the file system, and a second size, defaultsize2, for each patent client record stored in the file system. In 812, the total size of the file system for the medical office application is based on defaultsize3. Rules 810 and 812 illustrate calls to the same API of the level 3 service in which the parameters of the call have different values determined by the level 1-level 2 mapping rules.

[0084] Referring to FIG. 10, shown is another example of a function that may be used to select a particular rule set. The example 900 illustrates a 4-dimension mathematical function, F, in 902 representing in a parameterized form a function that may be used in connection with selecting a rule set. Element 902 of FIG. 10 provides a fourth parameter, vertical market, in addition to those previously illustrated in FIG. 6. As a fourth parameter value that may be specified in connection with selecting a rule set, a vertical market may be specified such as indicated by 904. The vertical market may specify a particular specialty or niche market such as for a professional group. In one embodiment, a different rules set may be specified for the same combination of user grouping, application, and data service. For example, with reference back to FIG. 9, the different user interface data 802 and mapping rules 804 may be specified for the same application in which the user interface data is customized for interaction with the particular law and medical vertical market segments. As such, a different rule set may be used for the same application, user grouping, and data service in which only the level 1 to level 2 mapping rules may vary.

[0085] Referring to FIG. 11, shown is a flowchart of processing steps that may be performed for each application for which the data storage system will perform processing using the techniques herein. The flowchart 1000 generally outlines analysis or the steps that may be performed for each application by developers implementing the techniques herein. At step 1002, the one or more user groupings and associated levels are determined. Each user groupings may specify a number of user interaction levels in which levels vary with the particular end users of the application. At step 1004, the vertical markets may be determined. Step 1004 may be an optional step or may result in only a single vertical market being determined of there is no rule set variation for different vertical markets. Similarly, with respect to step 1002, a single user grouping (e.g., single user grouping with 3 levels or layers) may be determined. At step 1006, the data services provided by the application are determined. At step 1008, the application may be profiled for the data services, vertical markets and user groupings determined in previous steps. The profiling may describe how the application interface with the underlying data storage when the data service is provided for the user groupings in the different vertical markets. Step 1008 may include determining the best practices for implementing a particular data storage configuration request. When performing requests for an application, the profiling describes how that request is to be implemented. Step 1008 may include, for example, determining application specific best practices as may be reflected in the UI language and terms and mapping rules for the different levels. The best practices may also vary with each storage vendor as reflected, for example, in the level 2-3 mapping rules described herein by specifying vendor specific attributes for each application or selected groups of different applications and/or services. At step 1010, the profiling information for the application from step 1008 may be expressed in a parameterized form using the rules, APIs, and functions as described herein to define the framework used by the data storage system in connection with processing a user request.

[0086] Referring now to FIG. 12, shown is a flowchart 1100 of processing steps that may be performed by a data storage system in connection with the techniques herein. At step 1102, an incoming user configuration request is received. At step 1104, one or more rule sets may be selected. In one embodiment as described herein, the request may not be executed immediately. Rather, as described in subsequent steps, the user allowed to preview a work list of the tasks to implement the request. At step 1106, the mappings to implement the request may be processed and the API calls between the different service providers may performed to generate the work list. Step 1106 may provide for determining the specific tasks that are to be executed to complete the request received. The specific tasks may be included in the work list and provided to the user for review at step 1108. At step 1110, the user may accept or, reject the work list. If the user does not accept, step 1110 evaluates to no and rejection processing 1114 is performed. Step 1114 may include, for example, outputting a message that the request will not be performed and waiting for the next user input. If step 1110 evaluates to yes, control proceeds to step 1112 to perform processing to execute the request in accordance with the work list. At step 1116, a determination is made as to whether the work list tasks were performed successfully. If not, control proceeds to step 1120 to perform failure processing. Step 1120 may include a variety of different options such as, for example, attempting to retry the failed operation a number of times, outputting an error message, undoing or rolling back processing performed in the work list up to the failure point so that the data storage system is placed back in a state before the work list as executed, and the like. If step 1116 evaluates to yes, control proceeds to step 1118 to according perform success processing such as, for example, indicate completion of the request to the user with a message.

[0087] It should be noted that as part of the review process of step 1108, a user may examine the different objects and entities used to see the result or impact to the data storage system if the request is executed. For example, a level 1 user request provisioning storage for a file system may see how much storage would be allocated for the request if the request processing is executed. Such information may be important in evaluating the impact of the request and determining whether a user wants to execute the request.

[0088] An embodiment may implement the techniques herein using code executed by a computer processor. For example, an embodiment may implement the techniques herein using the rules, rules engines, and the like, using code which is executed by a processor of the data storage system. As will be appreciated by those skilled in the art, the code may be stored on the data storage system on any one of a computer-readable medium having any one of a variety of different forms including volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by a data storage system processor.

[0089] The foregoing provides a flexible approach for automated implementation of best practices that can be customized in accordance with the particular application, data service, and/or data storage system. The best practices may vary with application as well as the particular data storage system. A user may select a level of interaction with the system in which the level selected varies the assumed knowledge or user sophistication, level of detail, and level of automation for the particular application. The user may select a level, such as level 1, to obtain a greater level of automation of best practices customized for the particular application. A user may also select to obtain a lesser level of automation of best practices as the user knowledge level and sophistication increases. The selected level may be associated with a particular user interface, level of automation and interaction with the data storage system for performing data services for a particular application. The automation of the best practices may be implemented using a variety of different frameworks and infrastructures. The exemplary one set forth herein uses a rule-based system although it will be appreciated by those skilled in the art that others are possible to implement the techniques set forth herein.

[0090] What will now be described are techniques that may be used in a data storage system in connection with licensing and security.

[0091] It should be noted for purposes of illustration and example, a data storage configuration request is described in following paragraphs for use with the techniques herein of licensing and security. However, it will be appreciated by those skilled in the art that the techniques herein may be used in connection with other types of data storage requests such as other types of data storage management requests including monitoring requests, for example, to read or observe different elements in the data storage system regarding storage for one or more applications, available storage, and the like.

[0092] Referring to FIG. 13, shown is an example 1200 illustrating the service providers previously described in connection with FIG. 2. FIG. 13 includes the components of FIG. 2 with the addition of objects 1202, 1204 and 1206. As described elsewhere herein, the request may be initially received by the data storage system from a user interacting with the data storage system at one of the various levels or layers. In an object-based implementation, each of the service providers may perform one or more operations on objects, such as 1202, 1204 and 1206, in connection with servicing a received data storage system configuration request. The request may be issued by a user, such as on a host, to the data storage system. The request may be received by one of the service providers, such as one of 104a, 104b, and 104c. Depending on the user selected level of interaction with the data storage system, the user may supply different information with the request that varies with the service provider interface at the selected level. The levels may vary with assumed proficiency or knowledge regarding the configuration request being made and the data storage system in connection with servicing the request for the particular application.

[0093] The different levels of service providers form a hierarchy of service providers. A user may interact with the service providers at level n. In turn, service providers at level n may interact with service providers at the same or other levels in connection with servicing the request as also described in more detail elsewhere herein. As a result of the service provider interactions in an embodiment using an object-based approach, servicing the request may include operating on a hierarchy of objects associated with the different service provider levels. For example, a user may interact with the data storage system at level 1 and issue a request to the service provider 104a. The service provider 104a may perform operations in connection with level 1 objects 1202. The service provider at level 1 may also issue a request for service to another service provider, such as service provider 104b, in connection with servicing the request. Service provider 104b may perform operations on level 2 objects 1204 in response to the request from service provider 104a. In turn, service provider 104b may issue a request to service provider 104c resulting in an operation on level 3 objects as part of servicing the request initially received from a user by service provider 104a. Thus, an initial request at upper levels in the hierarchy may result in a chain of requests for subsequent operations on objects at various lower levels further toward the bottom of the hierarchy as part of servicing the initial request. Referring back to FIGS. 4 and 5, such a cascading effect of requests is illustrated, for example, by a request issued to service provider 204a at level 1 to service the create filesystem request 310. As part of servicing request 310, different objects may be created and operated upon by the service providers 204a and 204b in connection with the data included in 312 and 314.

[0094] The techniques of security and licensing as described herein may be used to control the various operations and interactions which occur in connection with servicing a data storage system configuration request received by the data storage system. In accordance with one aspect, security and/or licensing techniques described herein may be used to control which requests received by a service provider are serviced. The request may be that which is initially received by the data storage system, such as from a user interacting with the data storage system. The request may also be a request made from one service provider to another service provider as one step in connection with servicing the received data storage configuration request. In this latter instance, each service provider may perform one or more processing steps to service a data storage configuration request received from a user. The interactions between one of the service providers and a user or other entity sending a request received by the data storage system may be illustrated, for example, by 112a, 112b and 112c. The interactions between the different service providers at different levels may be illustrated, for example, by 114a, 114b, 114c, and 114d. The service providers at the upper or top levels in the hierarchy may issue proxy requests to other service providers on behalf of the user or other entity making the request initially received by the data storage system.

[0095] It should be noted that, although FIG. 13 and others herein illustrate an object-based implementation, the techniques herein may be used in connection with other non-object based implementations. In connection with performing the requested operations on objects by the different service providers, access methods may be defined which are invoked to perform different operations on the objects.

[0096] Referring to FIG. 14, shown is an example of the different service providers at different levels and the objects utilized by each level. The example 1250 includes the service providers 204a, 204b and 204c as described in connection with FIG. 4. The example 1250 illustrates the different objects 1252, 1254 and 1256 operated upon, respectively, by service providers 204a, 204b and 204c. FIG. 14 also illustrates the different UIs 1258, 1260 and 1262 that may be used to interact, respectively, with the service providers 204a, 204b and 204c at different levels when issuing a data storage configuration request to the data storage system.

[0097] In accordance with the security techniques described herein, a mechanism may be used in connection with controlling operations performed for servicing requests received by the data storage system, such as from a user issuing a request to a service provider as illustrated by connections 1278a, 1278b and 1278c. In accordance with another aspect of the security techniques described herein, a mechanism may be used in connection with controlling operations performed for servicing requests made between service providers as illustrated by connections 1254a, 1256a, and 1278d, as part of servicing an initially received user request.

[0098] In one embodiment implementing the security techniques described herein, each of the objects 1252, 1254, and 1256 may have an associated access control list (ACL). An ACL may specify a list of permissions attached to an associated object. The list specifies the particular entities or subjects allowed to access the object and the particular operations that may be performed by each such entity. ACLs specify, for a given entity, which operations are allowable or permissible for the associated objects. ACLs and their use in connection with the techniques herein will be described in more detail in following paragraphs. In accordance with another aspect of the security techniques herein, a user issuing the request received by the data storage system may be granted particular authorities or rights. In connection with a request resulting in an operation on an object by a service provider, the service provider may make a determination as to whether the user making the request has been granted the authority or access rights needed to perform the requested operation on the object. The service provider may receive a request from a user resulting in an operation on an object. The service provider may compare the permissions needed to perform the requested operation (e.g., an operation to create an object, modify an object, and the like) with the granted rights or the list of permissible access rights for the user as specified in the ACL associated with the object. If the user has not been granted the permissions needed to perform the operation, the service provider does not perform the operation.

[0099] In one embodiment described in following paragraphs, a role-based access control technique may be used in which rights or permissions are assigned to different roles, and one or more roles are then assigned to one or more users. An ACL may indicate the permissible access rights for each role for the object associated with the ACL. As an example, a user may issue a request to service provider 204c at level 3. Service provider 204c may determine that in connection with servicing the request, an operation on object 3 is performed. The operation may be to update or write to portions of object 3 in accordance with a defined access method for performing the operation. The ACL 1274 may indicate that the user does not have the needed permissions to perform the requested operation. The user may have an assigned role for which the ACL only provides read access to object 3 1256.

[0100] It should be noted that role-based access control is just one type of access control model that may be used in connection with the techniques herein. Other types of access control models, such as assigning permissions directly to individual users, may also be employed using the techniques herein.

[0101] Besides controlling the operations performed by a service provider when an externally generated request from outside the data storage system is received by the data storage system, the ACL may be used in connection with controlling requests made from one service provider to another. As described herein, a data storage configuration request may require processing by different service providers at different levels operating on multiple objects. In connection with a first request received from a user, one or more other requests may be indirectly made on behalf of the first request at different levels in the service provider hierarchy. Such requests may be characterized as proxy requests between service providers made on behalf of the user's first request. The ACL may indicate as allowable proxy requests or requests between service providers for operations needed in connection with completing service for the first request.

[0102] In one aspect, a data storage configuration request received by the data storage system may require multiple processing steps to complete in which different portions of the processing steps are performed by multiple service providers at different levels. The ACLs may indicate allowable operations resulting from a proxy request. In other words, the ACLs may indicate as allowable the operations a first service provider may request of another service provider in order to complete the initially received data storage system configuration request. For example, a user request at level 1 to service provider 204a may require operations on objects 1252, 1254 and 1256. Service provider 204a may perform operations on object 1252. A first proxy request may be issued from service provider 204a to 204b resulting in operations to object 1254. Subsequently, a second proxy request may be issued from service provider 204b to service provider 204c resulting in operations to object 1256. The ACL 1272 may indicate as allowable the operation on object 1254 when performed in connection with the first proxy request. The ACL 1274 may indicate as allowable the operation on object 1256 when performed in connection with the second proxy request. However, as will be illustrated in more detail in following paragraphs, the ACLs 1272 and 1274 may not allow the same foregoing operations associated with the proxy requests to be performed if the user directly interacts with provider 204b. In other words, an ACL may indicate that an operation on an object may be allowable if initiated via a proxy request on behalf of a user. Yet, if the user directly requests that the same operation be performed on the same object, the ACL may indicate that the operation is not allowable. In connection with implementation of the best practices as described herein in accordance with different levels of entry or issuance of user requests, allowing such proxy requests may be needed to perform multiple operations in connection with servicing a data storage configuration request. Additionally, using the security techniques herein, requests to perform the multiple operations may be denied if made directly to the service providers by the user. Thus, the security techniques herein may be used to allow those operations necessary to perform a data storage configuration request but may also provide a controlling mechanism restricting when the same operations may also be performed. The security techniques may be used to afford protection, for example, by disallowing less proficient, users from directly performing selected operations. However, if the same operations are indirectly performed as part of a best practice implementation for the application when the user initiates a level 1 data storage configuration request, the same operations are allowed.

[0103] In connection with the requests made between service providers as indicated by 1254a, 1256a, and 1278c, it should be noted that the requests may be made in either direction between service providers at different levels. In other words, a request may be made from a service provider at a top level (e.g., level 1) in the hierarchy to another service provider further down in the hierarchy (e.g., level 2 or 3). A request may also be made from the lower level further down in the hierarchy (e.g., level 3) to a level above in the hierarchy (e.g., level 2 or 1).

[0104] Referring to FIG. 15, shown is an example illustrating in more detail the different types of requests and associated directional flow. The illustration 1300 includes a first example 1302 in which a request 1306a is issued directly to the level 1 service provider. An indirect or proxy request 1306b is issued from the level 1 service provider to the level 2 service provider as part of servicing the request 1306a. The proxy request 1306b may result in performing an operation on object 2. A second example 1304 is also included in which a request 1308b is issued directly to the level 3 service provider. An indirect or proxy request 1308a is issued from the level 3 service provider to the level 1 service provider as part of servicing the request 1308b. The proxy request 1308a may result in performing an operation on object 1.

[0105] Requests 1306a and 1308b may be characterized as direct requests with respect to a service provider (e.g., requests directly sent to the service provider from the user). Requests 1306b and 1308a may be characterized as indirect or proxy requests between service providers subsequently issued as part of servicing an initial user request. Example 1302 illustrates a proxy request flow from an upper level to a lower level in the service provider and object hierarchy. Example 1304 illustrates a proxy request flow from a lower level to an upper level in the service provider and object hierarchy.

[0106] The service provider (e.g., level 1 service provider) may include information in a request (e.g., 1306b) specifying that the request is a proxy request. In one embodiment as described in following paragraphs, a security policy may be implemented in which all operations may be allowed for selected objects at different levels in the service provider hierarchy if the operations are performed as a result of a proxy request (e.g., between service providers). In such an embodiment, all operations made as a result of proxy requests may be allowed for selected objects in connection with both the directional flows illustrated in 1302 and 1304. However, it should be noted that an embodiment may implement different and more restrictive security policies in connection with proxy requests resulting in operations on objects. Different information may be included in the proxy request as needed in accordance with implementing the particular security policy in an embodiment. For example, in implementing the best practices described herein, a proxy request from the level 1 service provider resulting in performing a first operation on object 2 by the level 2 service provider may never be issued in the downward direction as illustrated in 1302. As such, the ACL for object 2 may disallow such an operation in connection with a proxy request since a legitimate request to perform such an operation may never be issued. In another embodiment, if the first operation on object 2 may be performed in connection with proxy requests issued by the level 1 service provider but not if the proxy request is issued by another level service provider, the ACL of object 2 may indicate the first operation as allowable for the level 1 service provider but not when the proxy request is from the other level service providers. As such, the ACL may be used to provide varying degrees or granularity of control depending on the security policy in an embodiment. As another example, an embodiment may pass as parameters user credentials such as user ID, associated role(s), and the like, when making a proxy request. In such an embodiment, a determination as to whether the proxy request is allowable may be made in accordance with an indicator regarding proxy requests and the user credentials. For example, an ACL or other mechanism may be utilized which includes an indicator as to whether any proxy request is allowable. In combination with this indicator, the user credentials of the initiating requester may be examined to determine if proxy requests for the user ID, role(s), from the particular service provider, may be performed. For example, an ACL may indicate that proxy requests made from a level 2 service provider to a level 3 service provider on behalf of users having a first assigned role are allowable. If the same proxy request is issued from a user having a second different role, the proxy request may not be allowable as indicated by an ACL or other mechanism used in an embodiment. As such, the user ID and/or role(s) may be passed in connection with the proxy request.

[0107] Referring to FIG. 16, shown is an example 1400 illustrating a role-based access model with ACLs in connection with the techniques herein. As described elsewhere herein, role-based access control may include defining a list of roles as illustrated in element 1402. The roles may relate to a job function, title, skill or proficiency level, and the like. In this example, the roles 1-3 define different proficiency levels a user may be assigned in connection with performing data storage configuration operations for a particular application. Role 4 is associated with a user that may perform a monitoring function such as in connection with learning about the different objects existing at the different levels. For example, a user may want to observe what objects are created as a result of implementing the best practices for data storage provisioning for an email application. A set of roles and ACLs may be specified for each application having data hosted on the data storage system. Element 1402 includes 4 roles: novice (role 1), intermediate (role 2), advanced, (role 3), and monitor (role 4). Role 1 may correspond to a first level of proficiency such as may be associated with a user interacting with the data storage system at level 1 in FIG. 13. Role 2 may correspond to a second level of proficiency (greater than level 1) such as may be associated with a user interacting with the data storage system at level 2 in FIG. 13. Role 3 may correspond to a third level of proficiency (greater proficiency than levels 1 and 2) such as may be associated with a user interacting with the data storage system at level 3 in FIG. 13. Role 4 may correspond to a user observing or viewing results of requests and operations as may be issued by other users.

[0108] Element 1416 indicates the various roles that may be assigned to users of the data storage system. A user may be assigned one or more roles and a single role may also be assigned to multiple users. User ID1 is assigned role 1. User ID2 is assigned role 2. User ID3 is assigned role 3. User ID4 is assigned role 1 and role 4. In this example, user ID1 may be a user attributed with having the first level of proficiency in connection with performing data storage configuration for an application. It may also be the case that the user utilizing the account associated with ID1 has greater proficiency. However, for security reasons, this user is only granted limited rights in accordance with this first level of proficiency. Similarly, user ID2 may be a user attributed with having the second level of proficiency in connection with performing data storage configuration for an application. It may also be the case that the user utilizing the account associated with ID2 has greater proficiency but it may be desirable to limit the rights granted to those associated with role 2 for security reasons. User ID3 may be a user who has level 3 proficiency and is allowed to issue requests at level 3. User ID4 may be a user having minimal proficiency as indicated via role 1 assignment. However, user ID4 may be in the process of learning about what is implemented at the bottom levels in the hierarchy in connection with the automated techniques for implementing best practices for data storage configuration, for example, when user ID4 issues a level 1 request. As such, user ID4 may issue a level 1 request and then use the observation or read access permitted with the monitoring functions of role 4 to see the resulting objects created at levels 2 and 3.

[0109] The example 1400 includes object 1404 with associated ACL 1410, object 1406 with associated ACL 1412, and object 1408 with associated ACL 1414. Object 1404 may be a level 1 object (e.g., from 1202 of FIG. 13). Object 1406 may be a level 2 object (e.g., from 1204 of FIG. 13). Object 1408 may be a level 3 object (e.g., from 1206 of FIG. 13). Each of the ACLs 1410, 1412 and 1414 include a list of roles and granted or permissible operations allowed for the object associated with each ACL. It should be noted that each ACL also includes a “proxy” indicator which may not be characterized as a role but rather indicates the allowable operations when the operations are made in connection with a proxy request from a service provider. This is in contrast to the use of roles in the ACL which indicate permissible operations in connection with a direct request issued from a user rather than a service provider. As described above, for purposes of simplicity in illustration, all operations on objects 1404, 1406 and 1408 are indicated as allowable when resulting from a proxy request from a service provider. As also described above, an embodiment may implement variations of the foregoing in accordance with the particular object, operation and security policy.

[0110] To further illustrate with reference to FIGS. 13 and 16, in accordance with the defined roles and ACLs 1410, 1412 and 1414, user ID1 having role 1 is allowed to only make direct requests resulting in operations on objects to the level 1 service provider. However, if proxy requests are made between service providers in connection with the automated techniques described herein for implementing a data storage configuration request at level 1, operations resulting from the proxy requests are allowed. User ID2 having role 2 is allowed to make direct requests resulting in operations on objects to the level 1 and the level 2 service providers. Since user ID2 has level 2 proficiency, user ID2 may be allowed to issue requests directly resulting in operations on objects of the level 1 service provider as well but not for level 3. User ID3 is allowed to make direct requests resulting in operations on objects to the level 1, 2 and 3 service providers. User ID4 is allowed to make direct requests resulting operations on objects to the level 1 service provider and also allowed to issue requests for performing read operations on objects to any level service provider. Such protections allow user ID4 to gain knowledge about data storage configuration options and settings (via the permitted read access) without allowing ID4 to perform update operations (e.g., write access operations) via a direct request issued to the level 2 or level 3 service provider.

[0111] The ACLs included in FIG. 16 are illustrative of one security policy that may be implemented using the techniques herein. It should be noted that the specification of permissions associated with proxy requests, or requests from one service provider to another, may be indicated using another mechanism besides the ACL as described herein. In connection with FIG. 16, different types of data storage system management requests, such as requests for data storage configuration as well as monitoring, are illustrated.

[0112] In the foregoing, security techniques have been described that may be utilized in an embodiment. The security techniques may be implemented in an embodiment alone, or in combination with, licensing techniques that will now be described.

[0113] A customer may license software used on the data storage system in connection with servicing a data storage configuration request. For example, a customer may license the software executed on the data storage system in connection with servicing user requests issued at one or more levels of the service provider hierarchy. The software license may include licensing provisions or terms specifying permissions, rights and restrictions regarding software use. The license provisions may be specified using various licensing configuration options and settings on the data storage system. For example, a software license provision may indicate a time period during which the customer is allowed to use the software. After an indicated expiration date, the customer may be unable to successfully invoke the licensed software. Additional licensing software on the data storage system may be used in connection with appropriately setting licensing configuration options reflecting the licensing provisions. Current licensing provisions for installed and licensed software may be indicated on the data storage system using any one of a variety of different techniques. For example, a licensing configuration file may specify the currently active licensing provisions such as the expiration date. When an attempt is made to launch the licensed software or otherwise perform an operation using the licensed software, processing may be performed to determine whether the requested launch or particular operation is in accordance with the licensing provisions and/or security provisions. One or more of the license provisions indicated, for example, in the licensing configuration file, may be relevant for use with the techniques herein although other licensing provisions may also be specified.

[0114] Referring to FIG. 17, shown is an example illustrating different sets of license terms or provisions that may be indicated in a licensing configuration file and used in connection with the techniques herein. The example 1500 illustrates 3 different sets of license terms 1502, 1504 and 1506. The license may include provisions other than as illustrated in the example 1500 since, for purposes of simplicity in illustration, FIG. 17 includes provisions that may be used in connection with the techniques herein. In connection with the license provisions for use with the techniques herein, the examples indicate those licensing provisions for which access is allowable and other accesses may be disallowed. The license terms in the examples of 1500 may be applicable to software used in connection with performing techniques described elsewhere herein for automated implementation of best practices that can be customized in accordance with the particular application, data service, and/or data storage system.

[0115] Element 1502 includes terms of license A in which a customer has licensed software on the data storage system to allow a user to interact with the data storage system at level 1 only. License A indicates as allowable servicing user requests received by service providers at level 1 for all operations. License A also includes a provision allowing all proxy requests initiated by level 1 service providers. Element 1504 includes terms of license B in which a customer has licensed software on the data storage system to allow a user to interact with the data storage system at level 1 and level 3 only. License B indicates as allowable servicing user requests received by service providers at levels 1 and 3 for all operations. License B also includes a provision allowing all proxy requests initiated by level 1 and level 3 service providers. License C indicates as allowable servicing user requests received by service providers at level 3 only for all operations. License C also includes a provision allowing all proxy requests initiated by level 3 service providers. The licensing provisions are specified in terms of controlling operations in accordance with the service provider and object hierarchy described herein. The licensing provisions also indicate the different one or more levels at which a user may interact directly with the data storage system as well as the degree to which proxy requests may be processed.

[0116] When determining whether a particular operation on an object is allowable, the licensing provisions may be examined in combination with the security enabled provisions as described herein. For example, FIG. 16 indicates the security enabled provisions for the different user IDs and ACLs. To illustrate, license A terms of 1502 may be in effect in the data storage system and user ID1 may interact with the data storage system at level 1 and successfully issue a data storage configuration request. The request is permitted via the license provisions and via the assignment of role 1 to user ID1 and the permissions granted in the ACL1. Additionally, any operations performed in connection with proxy requests initiated by the level 1 service provider are also indicated as allowable in the ACLs 1410, 1412 and 1414 and the license provisions of 1502. In contrast, an attempt by user ID2 to interact with the data storage system at level 2 and issue a data storage request fails since, although such a request is allowable in accordance with the role assigned to user ID2 and the permissions granted via ACL 1412, the license A terms of 1502 does not indicate such a request as allowable. Furthermore, user ID2 is not allowed to issue her request if any of the licenses 1504 or 1506 are in effect.

[0117] As another example, the terms of license B 1504 may be in effect in the data storage system and user ID4 may interact with the data storage system at level 1 and successfully issue a data storage configuration request. Later on, user ID4 may also successfully issue requests to service providers at level 3 to view various objects resulting from the direct level 1 request. Requests by user ID4 to view level 2 objects fail in accordance with the license terms although such requests are allowable via the assigned roles and ACLs of FIG. 16.

[0118] As yet another example, different licensing options may be purchased for each of the different available levels. A license may be purchased in which direct requests from all 3 levels of FIG. 16, as well as all proxy requests between all level service providers, are allowable. In such an embodiment, the users may have different roles in accordance with each level from which direct requests may be issued. In other words, as illustrated in FIG. 16, Roles 1-3 of element 1402 may be specified and accordingly associated with different user IDs depending on the direct requests each user ID is allowed to perform. The license terms may indicate that any user can issue any direct or indirect request. However, the security controls of the ACLs and associated roles may be used to restrict which users are allowed to issue direct requests at one or more different levels.

[0119] Referring to FIG. 18, shown is a flowchart of processing steps that may be performed in an embodiment in connection with an exemplary set of conditions in which the terms of license A 1502 are enabled in combination with the security provisions of FIG. 16. The steps of 1600 may be performed in connection with user ID1 interacting with the data storage system at level 1. At step 1602, the provisions of license A are specified on the data storage system. This may be performed, for example, as part of the installation process for software on the data storage system. At step 1604, user ID1 may be interacting with the data storage system at level 1 and may issue a level 1 service request. As illustrated in subsequent steps, implementation of the level 1 service request on the data storage system will require operations on object 1, object 2 and object 3 as illustrated in FIG. 16 at different levels of the hierarchy. At step 1606, the request is received by a level 1 service provider. The level 1 service provider determines that the user ID1 has the necessary permissions to perform the operation on object 1 at level 1 in accordance with the currently enabled license terms and security provisions. The operation is performed on object 1. Subsequently, the level 1 service provider issues a first proxy request to a level 2 service provider. At step 1608, the level 2 service provider determines that the first proxy request results in an operation on object 2. The level 2 service provider determines that the operation on object 2 is permitted for the first proxy request in accordance with the license terms and security provisions. The operation is performed on object 2. At step 1610, the level 2 service provider issues a second proxy request to a level 3 service provider. At step 1612, the level 3 service provider determines that the second proxy request results in an operation on object 3. The level 3 service provider determines that the operation on object 3 is permitted for the second proxy request in accordance with the license terms and security provisions. The operation is performed on object 3.

[0120] The steps of flowchart 1600 illustrate processing that may be performed for a request issued by a particular user ID with a set of license terms and security provisions enabled. It will be appreciated by those skilled in the art having the benefit of this disclosure that processing may similarly be performed in connection with different combinations of user IDs, license terms, and security provisions enabled.

[0121] Referring to FIG. 19, shown is a flowchart of processing steps as may be performed in an embodiment in connection with the techniques herein. The flowchart 1700 more generally illustrates processing steps described in connection with utilizing currently enabled security and licensing provisions in connection with processing a request. The request may be a data storage configuration request received by the data storage system, such as by a user interacting with the data storage system. Alternatively, the request processed in the steps of 1700 may also be a proxy request. At step 1702, the request may be received by a level n service provider. At step 1704, the level n service provider determines the object and operation to be performed on the object in connection with the request. The current relevant license provisions may also obtained as part of step 1704. At step 1706, a determination is made as to whether the request is a direct request (e.g., directly issued from a user) or a proxy request (e.g., from a service provider). If the request is a proxy request, step 1706 evaluates to no and control proceeds to step 1708. A determination is made at step 1708, in accordance with the license and security provisions, whether the operation is allowed in the context of a proxy request. If step 1708 evaluates to no, control proceeds to step 1710 where the operation is not performed and an error may result. If step 1708 evaluates to yes, control proceeds to step 1712 to perform the operation determined in step 1704.

[0122] If step 1706 evaluates to yes, control proceeds to step 1714 to obtain the one or more roles for the user ID making the request. At step 1716, the granted permissions indicated in the ACL of the object for the one or more roles are obtained. At step 1718, a determination is made, in accordance with the license and security provisions, whether the operation is allowed in the context of a direct request by the user ID. If so, control proceeds to step 1722 to perform the operation. Otherwise, control proceeds to step 1720 where the operation is not performed and an error may result.

[0123] In connection with determinations made at steps 1708 and 1718, the combination of the license and security enabled provisions may be examined. The conditions indicated by both the license and security enabled provisions may be logically ANDed together to make a determination as to whether to perform the operation. If any one of the license provisions or the security provisions indicate the requested operation is not permissible, the requested operation is not performed.

[0124] Referring to FIG. 20, shown is an example of a function representing use of the techniques herein when making a determination as to whether an operation on an object in connection with a particular request is allowable in accordance with currently enabled security and licensing provisions. The example 1800 represents this determination as a function 1802 including 3 sets of parameters 1804a, 1804b and 1804c. The first parameter set may indicate the one or more permissions needed for the request. The first parameter set 1804a may indicate the requested operation, the object upon which the operation is to be performed, and the type of request (e.g. direct or proxy) as illustrated in 1806. The second parameter set 1804b may indicate the granted permissions via the security provisions. The second parameter set may indicate the user ID, the role(s) for the user ID, and the security access provisions, for example as included in the ACL for both proxy requests (as may be issued between service providers on behalf of servicing a user request) and direct requests (as may be directly issued from a user to a service provider) as illustrated in 1808. The third parameter set 1804c may indicate the granted permissions specified in the license provisions 1810 that may be utilized with the techniques herein. Exemplary license provisions are illustrated, for example, in FIG. 17.

[0125] The function may return a boolean value (e.g., true or false) indicating whether the requested operation is allowable in accordance with the currently enabled security and license provisions. A value of true or 1 may indicate that the operation is allowable and a value of false or 0 may indicate otherwise.

[0126] An embodiment may use any one or more user authentication techniques when a user interacts with the data storage system such as when issuing data storage configuration requests to service providers at the various levels of the hierarchy. For example, an embodiment may use a two-factor authentication technique. An authentication factor is a portion of information used to authenticate or verify a user's identity for authentication purposes. Authentication factors may be characterized as belonging to three general categories: information known to a user (e.g., PIN, password), information related to something a user physically possesses (e.g., mobile phone, credit card, hardware security token), and information about the user, such as a biometric (e.g., fingerprint). Two-factor authentication is a technique whereby two factors such as from two different ones of the foregoing categories are used in authentication in order for a user to gain access to the data storage system.

[0127] The techniques described herein for security may be used as a control mechanism to provide a user with different levels of control in accordance with the user's proficiency and skill level. Such techniques may be used to restrict the operations that a novice user can perform. For example, the novice user may only be allowed to perform high level operations (e.g., level 1) so that the novice user is restricted from performing lower-level operations about which the novice user may lack knowledge. The licensing techniques may be used to restrict operations performed to those of particular levels in accordance with licensing provisions. For example, a first amount may be charged for customers to have only level 1 interactions. Additional monies may be charged for licenses which allow processing of requests received from a user at more than one level

[0128] While the invention has been disclosed in connection with preferred embodiments shown and described in detail, their modifications and improvements thereon will become readily apparent to those skilled in the art. Accordingly, the spirit and scope of the present invention should be limited only by the following claims.