Abstract: Technology is disclosed for managing network storage services by service level objectives (SLOs). The method receives multiple service level capability (SLC) templates; creates at least one storage service level (SSL) instance using at least one of the SLC templates; provisions a storage object located in a network storage infrastructure based on the SSL instance; and services storage requests using the storage object.

Abstract: The techniques introduced here provide for efficient creation and management of secure storage and backup in a cloud storage network. The techniques include a system and method for provisioning storage for a user in a cloud storage network. Using the techniques introduced here, a management module, upon receiving a request from a user for storage in a cloud storage system, determines a primary storage system and a secondary storage system for primary storage and backup storage, respectively, that meets the requirements of a service level selected by the user. The management module then creates and configures a primary virtual server and a secondary virtual server, for the primary storage and the backup storage, respectively, and provisions storage for the user. The techniques also include non-disruptive migration of data between virtual servers in response to a service level change.

Abstract: Technology is disclosed for managing network storage services by service level objectives (SLOs). The method receives multiple service level capability (SLC) templates; creates at least one storage service level (SSL) instance using at least one of the SLC templates; provisions a storage object located in a network storage infrastructure based on the SSL instance; and services storage requests using the storage object.

Abstract: A method, apparatus, and system are described herein, in which system resources and operations are assigned to roles in a role-based access control system, and the roles are assigned to a plurality of users. An RBAC system is used to resolve the client request to perform an operation on a resource, the RBAC system using a hierarchy of the plurality of resources to determine if a user is permitted to perform the operation on a parent of the resource in the hierarchy of resources. The RBAC system also determines if a user is permitted to perform the operation on the resource if a user group to which the user belongs to has the required access.

Abstract: An embodiment of a network manager permits a resource group administrator (with resource group level permissions but without global permissions) to add a global object to his/her resource group as a managed object, without requiring the administrator to have a global permission, as discussed further below. An embodiment of the network manager permits a resource group administrator to also edit the configuration settings that are attached to his/her resource group without requiring the administrator to have a global permission.

Abstract: A storage system includes a storage space provisioning system coupled to a primary storage server and a secondary storage server to resize a thin provisioned secondary volume on the secondary storage server. The storage space provisioning system detects data stored on a primary volume that is to be transferred to a secondary volume and obtains a point-in-time copy of the data stored on the primary volume. The storage provisioner determines a maximum transfer size of the data to be transferred using the point-in-time copy, and compares the maximum transfer size to a difference between the thin provisioned size of the secondary volume and a used size of the secondary volume. The storage space provisioning system increases the thin provisioned size of the secondary volume to be greater than the used size of the secondary volume plus the maximum transfer size when the maximum transfer size is greater than the difference.

Abstract: Described herein is a centralized access request authorization system comprising an authorization module, one or more server systems, and a collection of one or more storage systems connected through a network. An application executing on a server system receives an access request for accessing the storage system collection and sends an authorization request to the authorization module for authorizing the access request. The application may be configured to only send the access request to the storage system collection if it first receives an authorization of the access request from the authorization module. Since the application is configured to do such, the storage system performs the access request without performing any authorization verification on the access request.

Abstract: In an RBAC system, a capability is defined as including an operation and an object on which the operation is to be performed. The capability is assigned to a role, which is in turn assigned to a user. Whether a user's request to perform an operation on an object should be authorized is determined based on whether a capability to perform the operation on the object is assigned to a role which is in turn assigned to the user. Further, the authorization is determined based on the evaluation of the constraint(s) attached to the role. If the evaluation result of the constraint(s) disallows the user to assume the role, the user is prohibited from performing the operation on the object even the user has such capability.

Abstract: In an RBAC system, a capability is defined as including an operation and an object on which the operation is to be performed. The capability is assigned to a role, which is in turn assigned to a user. Then the user will have the authorization to perform the operation on the object. Rather than specifying the object by predetermining the identity of the object, an expression (e.g., a regular expression, a query, etc.) may be specified in place of the predetermined object. In response to a request initiated by a user, the expression is then evaluated to determine the identity of the object(s) on which the operation may be performed.

Abstract: An embodiment of a network manager permits a resource group administrator (with resource group level permissions but without global permissions) to add a global object to his/her resource group as a managed object, without requiring the administrator to have a global permission, as discussed further below. An embodiment of the network manager permits a resource group administrator to also edit the configuration settings that are attached to his/her resource group without requiring the administrator to have a global permission.