CN104517067A

CN104517067A - Method, device and system for data access

Info

Publication number: CN104517067A
Application number: CN201410850975.3A
Authority: CN
Inventors: 何益; 严华兵
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2014-12-30
Filing date: 2014-12-30
Publication date: 2015-04-15
Anticipated expiration: 2034-12-30
Also published as: CN104517067B

Abstract

The invention discloses a method, device and system for data access. The method comprises the following steps: receiving a data access request from a public virtual machine so as to request for accessing raw data in a storage system, wherein the data access request comprises information about users and operating types corresponding to the users; according to the operating types, judging whether the data which is requested for access by the data access request is the data with access authority attributes or not; if yes, according to metadata which is stored in a local memory and corresponds to the requested access data, determining whether the request for the data access has an access right or not, wherein the metadata comprises the information relevant to the users, and the operating types corresponding to the users, and the metadata stored in the local memory is locally loaded from the storage system; if the request for the data access has the access right, allowing the public virtual machine to access the raw data stored in the memory system through a private virtual machine. Through the manner, the method, device and system, disclosed by the invention, can accelerate the request for access, wherein the authentication is performed on the request for access.

Description

The method of visit data, Apparatus and system

Technical field

The present invention relates to virtual machine technical field of memory, particularly relate to a kind of method of visit data, Apparatus and system.

Background technology

The current application being stored in virtual machine field, there are three kinds of forms: the first is traditional mode, namely dummy machine system (as vmware) is by traditional network small computer system interface (InternetSmall Computer System Interface, be abbreviated as iSCSI) or network file system(NFS) (Network File System, is abbreviated as NFS) be linked in the storage system of far-end; The second is ServerSAN, namely stores the form unified with virtual machine; The third is between dummy machine system (as vmware) and remote storage system, adds the acceleration that a virtual machine optimization system is used for dummy machine system access.

Conventional is the third, concrete deployment form is: between dummy machine system (vmware) and storage system (Storage), dispose a virtual machine optimization system (as Atlantis ILIO, ILIO is also a virtual machine, ILIO does some and accelerates process, such as data buffer storage etc.), for the acceleration of dummy machine system access.Further refinement, the flow direction of the request of access (IO) that virtual machine is concrete is: the I/O request sent from the virtual machine (VM) of dummy machine system, arrive first virtual machine manager (Hypervisor), then these IO are mail to Atlantis ILIO by Hypervisor, are then sent to storage system (as: isomery array) by Atlantis ILIO by the agreement iSCSI of standard or NFS.

But the present inventor finds in long-term research and development, the function that technique scheme can only provide such as virtual machine image to accelerate, cannot support the acceleration that authentication is accessed.

Summary of the invention

The technical matters that the present invention mainly solves is to provide a kind of method, Apparatus and system of visit data, can provide acceleration for the request of access of authentication.

First aspect, the invention provides a kind of method of visit data, wherein, the virtual hard disk of public virtual machine maps within the storage system, private virtual machine is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described private virtual machine, and can transmission information mutually between described private virtual machine and described storage system, described method comprises: private virtual machine receives the data access request from public virtual machine, with the raw data in request access storage system, described data access request comprises user-dependent information and the action type corresponding with described user, described private virtual machine, according to described action type, judges whether the data of described data access request institute request access are the data with access rights attribute, if, then described private virtual machine is according to the metadata corresponding with the data that described request is accessed stored in local internal memory, determine whether described data access request has the authority of access, wherein, described metadata comprises user-dependent information and the action type corresponding with described user, and the metadata stored in described local internal memory is that described private virtual machine loads from described storage system, if described data access request has the authority of access, then described private virtual machine allows the described raw data of described public virtual machine by storing in the described storage system of described private virtual machine access itself.

In the first possible implementation of first aspect, described private virtual machine receives the data access request from public virtual machine, before the step of the raw data in request access storage system, comprising: described private virtual machine loads the metadata corresponding with there being the raw data of access rights in described storage system; After the described metadata loaded corresponding with there being the raw data of access rights, the IP address substitution of this locality is an IP address by described private virtual machine, and notify that its IP address substitution is a non-IP address by described storage system, wherein, a described IP address is the IP address of described storage system before replacing.

In conjunction with the first possible implementation of first aspect or first aspect, in the implementation that the second of first aspect is possible, described private virtual machine is according to described action type, after judging whether data that described request is accessed are the step of the data with access rights attribute, comprise: if having the data of access rights attribute, and do not have in the local internal memory of described private virtual machine to store the metadata corresponding with the data that described request is accessed, then described private virtual machine obtains the metadata corresponding with the data that described request is accessed by FileRPC agreement from described storage system, and according to the metadata corresponding with the data that described request is accessed obtained, determine whether described data access request has the authority of access.

In the third possible implementation of first aspect, described method also comprises: described private virtual machine receives the call back message from described storage system, described call back message notifies the metadata that described private virtual machine changes, so that described private virtual machine carries out crash handling to the described metadata changed.

In conjunction with first aspect, first aspect the first in any one possible implementation in the third, in the 4th kind of possible implementation of first aspect, described method also comprises: described private virtual machine, according to the operating habit of described public virtual machine, obtains metadata corresponding to data that described public virtual machine will access by FileRPC agreement from described storage system in advance.

Second aspect, the invention provides a kind of device of visit data, wherein, the virtual hard disk of public virtual machine maps within the storage system, described device section is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described device, and can transmission information mutually between described device and described storage system, and described device comprises: the first receiver module, judge module, authority determination module and allow access modules; Described first receiver module is for receiving the data access request from public virtual machine, and with the raw data in request access storage system, described data access request comprises user-dependent information and the action type corresponding with described user; The described action type that the data access request that described judge module is used for receiving according to described first receiver module comprises, judges whether the data of described data access request institute request access are the data with access rights attribute; It is when being the data with access rights attribute that described authority determination module is used in the judged result of described judge module, according to the metadata corresponding with the data that described request is accessed stored in local internal memory, determine whether described data access request has the authority of access, wherein, described metadata comprises user-dependent information and the action type corresponding with described user, and the metadata stored in described local internal memory loads from described storage system; Described permission access modules is used for, when described authority determination module determines that described data access request has an authority of access, allowing described public virtual machine to access in described storage system the described raw data stored.

In the first possible implementation of second aspect, described device also comprises: load-on module, address switchover module; Described load-on module is for loading the metadata corresponding with there being the raw data of access rights in described storage system; Described address switchover module is used for after described load-on module loads described corresponding with there being the raw data of access rights metadata, be an IP address by the IP address substitution of this locality, and notify that its IP address substitution is a non-IP address by described storage system, wherein, a described IP address is the IP address of described storage system before replacing.

In conjunction with the first possible implementation of second aspect or second aspect, in the implementation that the second of second aspect is possible, described device also comprises: the first acquisition module, described first acquisition module is used for when the data of described request access are the data with access rights attribute, and when not having in local internal memory to store the metadata corresponding with the data that described request is accessed, obtain the metadata corresponding with the data that described request is accessed by FileRPC agreement from described storage system; With data that described request the access corresponding metadata of described authority determination module also for obtaining according to described first acquisition module, determines whether described data access request has the authority of access.

In the third possible implementation of second aspect, described device also comprises: the second receiver module, described second receiver module is for receiving the call back message from described storage system, described call back message notifies the metadata that described device changes, so that described device carries out crash handling to the described metadata changed.

In conjunction with second aspect, second aspect the first to any one possible implementation in the third, in the 4th kind of possible implementation of second aspect, described device also comprises: the second acquisition module, described second acquisition module is used for according to the operating habit of described public virtual machine, obtains metadata corresponding to data that described public virtual machine will access in advance by FileRPC agreement from described storage system.

The third aspect, the invention provides a kind of device of visit data, wherein, the virtual hard disk of public virtual machine maps within the storage system, described device section is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described device, and can transmission information mutually between described device and described storage system, and described device comprises: receiver, processor, the storer be coupled with processor; Described receiver is for receiving the data access request from described public virtual machine, and with the raw data in storage system described in request access, described data access request comprises user-dependent information and the action type corresponding with described user; The data access request that described storer receives for storing described receiver, loads and next metadata from described storage system for storing; The data access request that described processor stores for transferring described storer, according to the described action type that described data access request comprises, judges whether the data of described data access request institute request access are the data with access rights attribute; Be when being the data with access rights attribute in judged result, according to the metadata corresponding with the data that described request is accessed stored in local internal memory, determine whether described data access request has the authority of access, wherein, described metadata comprises user-dependent information and the action type corresponding with described user; When described data access request has the authority of access, described public virtual machine is allowed to be accessed in described storage system the described raw data stored by described device.

Fourth aspect, the invention provides a kind of system of visit data, and described system comprises at least one server, at least one storage system, and described server is provided with at least one public virtual machine, at least one private virtual machine; The virtual hard disk of described public virtual machine maps within the storage system, described private virtual machine is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described private virtual machine, and can transmission information mutually between described private virtual machine and described storage system; Wherein, described private virtual machine receives the data access request from described public virtual machine, and with the raw data in storage system described in request access, described data access request comprises user-dependent information and the action type corresponding with described user; According to the described action type that described data access request comprises, judge whether the data of described data access request institute request access are the data with access rights attribute; Be when being the data with access rights attribute in judged result, according to the metadata corresponding with the data that described request is accessed stored in local internal memory, determine whether described data access request has the authority of access, wherein, described metadata comprises user-dependent information and the action type corresponding with described user; When described data access request has the authority of access, allow the raw data of described public virtual machine by storing in the described storage system of private virtual machine access itself.

5th aspect, the invention provides a kind of method of visit data, wherein, the virtual hard disk of public virtual machine maps within the storage system, private virtual machine is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described private virtual machine, and can transmission information mutually between described private virtual machine and described storage system, described method comprises: storage system is received public virtual machine and accessed the request having the raw data of access rights stored in described storage system by private virtual machine, wherein, the request of the raw data of access rights that has stored in described access storage system is when described private virtual machine judges that the data access request of described publicly-owned virtual machine has an authority of access, described private virtual machine sends to described storage system, described storage system obtains described raw data from the virtual hard disk being mapped in local described public virtual machine, described raw data is sent to described public virtual machine by described private virtual machine by described storage system.

In the first possible implementation in the 5th, described storage system receives before public virtual machine accesses the step of the request of the raw data stored in described storage system by private virtual machine, comprising: described storage system receives described private virtual machine and loads the request with the described metadata having the raw data of access rights corresponding; Described storage system obtain be kept at local, with the described metadata having the raw data of access rights corresponding, and described metadata is sent to described private virtual machine; Described storage system receives the IP address change notice of described private virtual machine, and own IP address is replaced by a non-IP address, wherein, a described IP address is the IP address of described storage system before replacing.

In the implementation that the second in the 5th is possible, described method also comprises: when described have metadata corresponding to the raw data of access rights to change time, described storage system sends call back message to described private virtual machine, described call back message notifies the metadata that described private virtual machine changes, so that described private virtual machine carries out crash handling to the described metadata changed.

In conjunction with the first possible implementation of the 5th aspect, in the third possible implementation in the 5th, described method also comprises: if described storage system is with the process of described private virtual machine transmission information, detect that described private virtual machine does not respond in the given time, then described storage system becomes the IP address of self again a described IP address automatically, is transferred directly in described storage system to make the data access of described public virtual machine.

6th aspect, the invention provides a kind of storage system, wherein, the virtual hard disk of public virtual machine maps within the storage system, private virtual machine is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described private virtual machine, and can transmission information mutually between described private virtual machine and described storage system, and described storage system comprises: the first receiver module, the first acquisition module and the first sending module; Described first receiver module is used for public virtual machine and is accessed the request having the raw data of access rights stored in described storage system by private virtual machine, wherein, the request of the raw data of access rights that has stored in described access storage system is that described private virtual machine sends to described storage system when described private virtual machine judges that the data access request of described publicly-owned virtual machine has an authority of access; Described first acquisition module is used for obtaining described raw data from the virtual hard disk being mapped in local described public virtual machine; Described first sending module is used for described raw data to send to described public virtual machine by described private virtual machine.

In the first possible implementation in the 6th, described storage system also comprises: the second receiver module, the second acquisition module, the second sending module and the first address switchover module; Described second receiver module loads the request with the described metadata having the raw data of access rights corresponding for receiving described private virtual machine; Described second acquisition module for obtain be kept at local, with the described metadata having the raw data of access rights corresponding; Described second sending module is used for described metadata to send to described private virtual machine; Described first address switchover module is for receiving the IP address change notice of described private virtual machine, and own IP address is replaced by a non-IP address, wherein, a described IP address is the IP address of described storage system before replacing.

In the implementation that the second in the 6th is possible, described storage system also comprises the 3rd sending module, described 3rd sending module be used for when described in have metadata corresponding to the raw data of access rights to change time, call back message is sent to described private virtual machine, described call back message notifies the metadata that described private virtual machine changes, so that described private virtual machine carries out crash handling to the described metadata changed.

In conjunction with the first possible implementation of the 6th aspect, in the third possible implementation in the 6th, described storage system also comprises the second address switchover module, described second address switchover module is used in described storage system with the process of described private virtual machine transmission information, when detecting that described private virtual machine does not respond in the given time, automatically become the IP address of self again a described IP address, be transferred directly in described storage system to make the data access of described public virtual machine.

The invention has the beneficial effects as follows: the situation being different from prior art, private virtual machine of the present invention receives the data access request from public virtual machine, with the raw data in request access storage system, data access request comprises user-dependent information and the action type corresponding with user; Private virtual machine, according to action type, judges whether the data of data access request institute request access are the data with access rights attribute; If, then private virtual machine is according to the metadata corresponding with the data of request access stored in local internal memory, determine whether data access request has the authority of access, wherein, metadata comprises user-dependent information and the action type corresponding with user, and the metadata stored in local internal memory is that private virtual machine loads from storage system; If data access request has the authority of access, then private virtual machine allows the raw data of public virtual machine by storing in private virtual machine access storage system itself.Load and next metadata from storage system owing to storing in private virtual machine internal memory, the request of the raw data of access rights that has stored in access storage system is when private virtual machine judges that the data access request of publicly-owned virtual machine has an authority of access, private virtual machine sends to storage system, thus a large amount of metadata operations is concentrated on this locality carry out, reduce the pressure to storage system, and acceleration authenticated user accesses, minimizing is repeatedly mutual with network, reduces overall access time delay.

Accompanying drawing explanation

Fig. 1 is the configuration diagram of method one embodiment of visit data of the present invention;

Fig. 2 is the process flow diagram of method one embodiment of visit data of the present invention;

Fig. 3 is the process flow diagram of another embodiment of method of visit data of the present invention;

Fig. 4 is the process flow diagram of the another embodiment of method of visit data of the present invention;

Fig. 5 is the structural representation of device one embodiment of visit data of the present invention;

Fig. 6 is the structural representation of another embodiment of device of visit data of the present invention;

Fig. 7 is the entity structure schematic diagram of device one embodiment of visit data of the present invention;

Fig. 8 is the structural representation of system one embodiment of visit data of the present invention;

Fig. 9 is the process flow diagram of the another embodiment of method of visit data of the present invention;

Figure 10 is the process flow diagram of the another embodiment of method of visit data of the present invention;

Figure 11 is the structural representation of storage system one embodiment of the present invention;

Figure 12 is the structural representation of another embodiment of storage system of the present invention.

Embodiment

Introduce some background knowledges related to the present invention below.

Visit data method of the present invention, Apparatus and system are relevant to software definition memory technology.Software definition stores (Software-defined storage, SDS) be a kind of data storage method, all control work relevant to storage is placed in the external software relative to physical store hardware by it, this software is not as the firmware in memory device, but on one server or as a part of operating system (OS) or Hypervisor.

Software definition storage can ensure that the memory access of system can manage more neatly on one accurately level.Software definition storage is out abstract from hardware store by software, and this also means that it can become one not by the shared pool of physical system restriction, more effectively to utilize resource.Store and also can be undertaken disposing and supplying by software and management, its supervisory routine can be simplified further by the automatic management based on strategy.Software definition stores and allows user need not purchase memory controller hardware from particular vendor, as the storage medium such as hard disk, flash memory.Further, if memory controller function is pulled out out, this function can be placed on any part of architecture, and it may operate on specific hardware, inner at Hypervisor, or walks abreast with virtual machine, forms real fusion architecture.

Below in conjunction with drawings and embodiments, the present invention is described in detail.

Consult Fig. 1, Fig. 1 is the configuration diagram of method one embodiment of visit data of the present invention, as shown in the figure, this framework comprises server 1, server 2 and storage system 3, wherein, two public virtual machines, 11, private virtual machine 12 and virtual machine manager Hypervisor13 are installed in server 1, two public virtual machines, 21, private virtual machine 22 and virtual machine manager Hypervisor23 are installed, i.e. each server deploy private virtual machine in server 2.Public virtual machine 11,21 also can be called user virtual machine, and private virtual machine 12,22 also can be called storage system adapter virtual machine, and the virtual hard disk of public virtual machine 11,21 is mapped in storage system 3.Wherein, the private virtual machine 12,22 in server 1, server 2 and storage system 3 form a cluster, can transmission information each other between them.

Generally, the original path of public virtual machine 11,21 visit data is: the I/O request sent from public virtual machine 11,21, arrive first virtual machine manager Hypervisor13,23, then these I/O request are sent to storage system 3 by Hypervisor13,23.

When server 1, private virtual machine 12 is deployed with in 2, when 22, in storage system 3, the IP address at data place to be visited automatically switches to private virtual machine 12, on 22 (see dotted line in figure Suo Shi), now public virtual machine 11, the new route of 21 visit datas is: from public virtual machine 11, 21 I/O request sent, arrive first virtual machine manager Hypervisor13, 23, then Hypervisor13, I/O request is sent to private virtual machine 12 by 23, on 22, private virtual machine 12, 22 authorities judging I/O request, when judged result is passed through, by private virtual machine 12, these I/O request are sent to storage system 3 by 22.That is, private virtual machine 12,22 belongs to the metadata operation of storage system 3 before taking over, in this way, the pressure of storage system can be reduced, avoid network interaction repeatedly, reduce overall time delay simultaneously, promote the bulk treatment ability of storage system.

Simultaneously, at server 1, private virtual machine 12 in server 2, in 22 clusters formed with storage system 3, storage system 3 is cluster masters, when having metadata to change in storage system 3, storage system 3 notifies private virtual machine 12, 22, original metadata is carried out crash handling, private virtual machine 12, 22 obtain new metadata from storage system 3, in this way, common virtual machine 11 can be made, I/O request during 21 visit data, I/O request during client personal computer's visit data, under the different scenes such as I/O request when I/O request during server access data or other office system visit datas, keep the consistance read and write data.

In framework of the present invention, due at server 1, private virtual machine 12 in server 2, in 22 clusters formed with storage system 3, storage system 3 is cluster masters, storage system 3 and private virtual machine 12, can transmission information mutually between 22, when storage system 3 detects that private virtual machine 12 does not respond in for a long time when busy (die or), the IP address at the I/O request corresponding data place of issuing private virtual machine 12 can be automatically brought in storage system 3 by storage system 3, in this way, can when storage system adapter virtual machine be died or is busy, I/O request is automatically brought in storage system, thus avoid the data access affecting public virtual machine.It should be noted that, in above-mentioned framework, server can be more than one or three, the public virtual machine installed in server can be more than one or three, as required, the private virtual machine installed in server also can be two or more, when the private virtual machine installed in server is two, in server, a part of public virtual machine is by one of them private virtual machine access storage system, and the public virtual machine of another part passes through wherein another one private virtual machine access storage system.Wherein, private virtual machine and storage system can same producer provide, and such private virtual machine and storage system each other transmission information are easy to realize; Or when being provided by different producers, the agreement formulating private virtual machine and storage system transmission information each other is also fine.

Consult Fig. 2, Fig. 2 is the process flow diagram of method one embodiment of visit data of the present invention, and present embodiment is the method flow diagram of private virtual pusher side.In present embodiment, the virtual hard disk of public virtual machine maps within the storage system, private virtual machine is deployed between public virtual machine and storage system, and public virtual machine, and can transmission information mutually between private virtual machine and storage system by private virtual machine access storage system.The method comprises:

Step S101: private virtual machine receives the data access request from public virtual machine, and with the raw data in request access storage system, data access request comprises user-dependent information and the action type corresponding with user.

Public virtual machine refers to the virtual machine of user in dummy machine system; Private virtual machine is deployed between public virtual machine and storage system, and for the raw data of public virtual machine access storage system provides optimization, public virtual machine is by private virtual machine access storage system; The operating system mirror image of public virtual machine leaves the operating system mirror image space of storage system in, the scratch diskette of each public virtual machine is mapped to the data space in storage system by network access server (Network Access Server, is abbreviated as NAS).

Action type refers to the action type can carried out raw data, such as: reading and writing etc.User-dependent information can be user name, login name etc.User-dependent information and the action type corresponding with this user can be used for judging whether this user possesses the authority of this action type.

Step S102: private virtual machine, according to action type, judges whether the data of data access request institute request access are the data with access rights attribute.

Different action types has different access rights.Some data is for the operation can only carrying out some users reading, and for the operation can carrying out read and write other user, the client also had can also possess the operations such as amendment or deletion, and these data belong to the data with access rights attribute; Also some data is to user without any restriction, and that is any user can access, and these data belong to the data without access rights attribute.

Step S103: if, then private virtual machine is according to the metadata corresponding with the data of request access stored in local internal memory, determine whether data access request has the authority of access, wherein, metadata comprises user-dependent information and the action type corresponding with user, and the metadata stored in local internal memory is that private virtual machine loads from storage system.

Can transmission information mutually between private virtual machine and storage system, therefore, private virtual machine can metadata in load store system, and is kept in local internal memory.In a concrete embodiment, the detailed process of this loading can be: after private virtual machine starts, issue broadcast message, after storage system receives broadcast message, set up with this private virtual machine and contact, the IP address at metadata place in storage system is sent to private virtual machine, private virtual machine is by this IP address metadata about load from storage system, after loading completes, carry out IP address switchover, private virtual machine is using the IP address of this IP address as oneself.Therefore, object is that the data access request of this IP address is transferred to this private virtual machine from storage system.

When the data of data access request institute request access are the data with access rights attribute, if and store the metadata corresponding with the data of request access in local internal memory, then can determine whether data access request has the authority of access according to the user-dependent information in the user-dependent information of this metadata and the action type corresponding with user, data access request and the action type corresponding with user.Such as: in data access request, user is called lm, action type writes; In the metadata corresponding with the data of request access, if the action type that user is called lm reads, so this data access request does not have access rights, if the action type that user is called lm is also write, so this data access request has access rights.

Step S104: if data access request has the authority of access, then private virtual machine allows the raw data of public virtual machine by storing in private virtual machine access storage system itself.

If data access request has the authority of access, so private virtual machine can allow the raw data of public virtual machine by storing in private virtual machine access storage system itself.That is, if data access request has the authority of access, so private virtual machine obtains raw data from storage system, and sends to public virtual to intend machine.

Embodiment of the present invention private virtual machine receives the data access request from public virtual machine, and with the raw data in request access storage system, data access request comprises user-dependent information and the action type corresponding with user; Private virtual machine, according to action type, judges whether the data of data access request institute request access are the data with access rights attribute; If, then private virtual machine is according to the metadata corresponding with the data of request access stored in local internal memory, determine whether data access request has the authority of access, wherein, metadata comprises user-dependent information and the action type corresponding with user, and the metadata stored in local internal memory is that private virtual machine loads from storage system; If data access request has the authority of access, then private virtual machine allows the raw data of public virtual machine by storing in private virtual machine access storage system itself.Load and next metadata from storage system owing to storing in local internal memory, thus a large amount of metadata operations is concentrated on this locality carry out, reduce the pressure to storage system, and accelerate authenticated user accesses, minimizing is repeatedly mutual with network, reduces overall access time delay.

Consult Fig. 3 to Fig. 4, Fig. 3 to Fig. 4 is the process flow diagram of other three embodiments of the method for visit data of the present invention, and these three embodiments are substantially identical with the embodiment of Fig. 1, and something in common refers to Fig. 1 and corresponding explanatory note, and the method comprises:

Step S201: the metadata corresponding with there being the raw data of access rights in private virtual machine load store system.

Step S202: after the metadata loaded corresponding with there being the raw data of access rights, the IP address substitution of this locality is an IP address by private virtual machine, and notify that its IP address substitution is a non-IP address by storage system, wherein, an IP address is the IP address of storage system before replacing.

After the metadata corresponding with there being the raw data of access rights in private virtual machine load store system, originally the IP address being storage system is taken, being about to local IP address substitution is an IP address, notifies that storage system changes the non-IP address that IP address is other simultaneously.After one IP address of storage system is occupied, the request of access of relevant access storage system is automatically handed on private virtual machine, thus shares the pressure of storage system.

Step S203: private virtual machine receives the data access request from public virtual machine, and with the raw data in request access storage system, data access request comprises user-dependent information and the action type corresponding with user.

Step S204: private virtual machine, according to action type, judges whether the data of data access request institute request access are the data with access rights attribute.

Step S205: if then private virtual machine judges whether store the metadata corresponding with the data of request access in local internal memory.If had, enter step S206, if do not had, enter step S207.

Step S206: according to the metadata corresponding with the data of request access stored in local internal memory, determine whether data access request has the authority of access, wherein, metadata comprises user-dependent information and the action type corresponding with user.

Step S207: private virtual machine is by file remote procedure call (File RamoteProcedure Call, being abbreviated as FileRPC) agreement obtains the metadata corresponding with the data of request access from storage system, according to the metadata corresponding with the data of request access obtained, determine whether data access request has the authority of access.

FileRPC agreement is the communication protocol of private virtual machine and the mutual transmission information of storage system, is also the proprietary protocol of access file, and the rule of this agreement is can be self-defining; When private virtual machine and storage system are same producers, the rule of this agreement is self-defined more flexible and changeable.If private virtual machine judges do not have in local internal memory to store the metadata corresponding with the data of request access, then directly can obtain the metadata corresponding with the data of request access by FileRPC agreement from storage system, then according to the metadata corresponding with the data of request access obtained, determine whether data access request has the authority of access.

Step S208: if data access request has the authority of access, then private virtual machine allows the raw data of public virtual machine by storing in private virtual machine access storage system itself.

Step S209: private virtual machine receives the call back message from storage system, the metadata that call back message notice private virtual machine changes, so that private virtual machine carries out crash handling to the metadata changed.

When the metadata in storage system changes, storage system sends call back message to private virtual machine, to notify which metadata changes, be convenient to private virtual machine and crash handling is carried out to the metadata changed, such as: the metadata changed is deleted, the metadata or before replacing by the new metadata obtained from storage system.In this way, upgrading in time of metadata can be realized, allow private virtual machine this locality store metadata and storage system in metadata be consistent; Under the different scenes such as I/O request when I/O request during I/O request, server access data during I/O request, client personal computer's visit data when can make common virtual machine visit data or other office system visit datas, keep the consistance read and write data.

It should be noted that, step S209 can perform or perform afterwards before step S208; If before step S208, the metadata in storage system changes, and storage system sends call back message to private virtual machine, then step S209 performed before step S208, so that more new metadata, make when execution S206, the metadata in private virtual machine is up-to-date; If after step S208, metadata in storage system changes, storage system sends call back message to private virtual machine, then step S209 performs after step S208, so that more new metadata, make when next time performs S206, the metadata in private virtual machine is up-to-date.

Step S210: private virtual machine, according to the operating habit of public virtual machine, obtains metadata corresponding to data that public virtual machine will access by FileRPC agreement from storage system in advance.

If the operating habit of private virtual machine to public virtual machine is known, so private virtual machine can obtain metadata corresponding to data that public virtual machine will access by FileRPC agreement from storage system in advance.Such as: private virtual machine can add up the data of public virtual machine access, thus obtains some operating habit of public virtual machine; If public virtual machine A is after visit data 1, inevitable visit data 2, so at public virtual machine A visit data 1, and private virtual machine this locality is not when having a metadata of data 2 correspondence, private virtual machine can obtain the metadata corresponding to data 2 from storage system in advance so that private virtual machine to be public virtual machine A ready by the metadata of visit data 2 correspondence.

In this way, access can be accelerated further, reduce time delay.

It should be noted that, step S210 can perform or perform afterwards before step S208; Such as, or for above-mentioned example, if now public virtual machine A is in the operation of data 1 that conducts interviews, and private virtual machine this locality does not have the metadata of data 1 correspondence, when needing to perform step S207, can be performed together by step S210 along band, that is step S207 performs together with step S210; If public virtual machine A is in the operation of data 1 that conducts interviews, and private virtual machine this locality stores the metadata of data 1 correspondence, then step S210 can perform the free time after step S208 again, in order to avoid affect the operation of public virtual machine visit data 1.

In a word, the execution sequence of step S209 and step S210 is not limited to the order shown in Fig. 3 and Fig. 4, can determine flexibly according to practical situations.

Method of the present invention also comprises: if storage system is with the process of private virtual machine transmission information, detect that private virtual machine does not respond in the given time, then the IP address of self becomes again by storage system is automatically an IP address, is transferred directly in storage system to make the data access of public virtual machine.

Owing to can be kept in touch by transmission information between storage system and private virtual machine, when storage system finds that private virtual machine does not respond in the given time, likely private virtual machine is died, or private virtual machine load is heavy too busy, when cannot respond, in order to not affect the data access of public virtual machine, storage system can carry out IP address switchover automatically, IP address by storage system self transfers an IP address automatically to, thus the data access of public virtual machine is transferred directly in storage system.This step is a kind of emergent step, when private virtual machine does not respond in the given time, by the way, can not affect the data access of public virtual machine.

Consult Fig. 5, Fig. 5 is the structural representation of device one embodiment of visit data of the present invention, this device is specifically for implementing function and the task of the private virtual machine mentioned in above-described embodiment, in present embodiment, the virtual hard disk of public virtual machine maps within the storage system, this device section is deployed between public virtual machine and storage system, and public virtual machine asks storage system by this device, and can transmission information mutually between this device and storage system.The device of present embodiment can perform the step of above-mentioned Fig. 1 to Fig. 4.This device comprises: the first receiver module 101, judge module 102, authority determination module 103 and permission access modules 104.

First receiver module 101 is for receiving the data access request from public virtual machine, and with the raw data in request access storage system, data access request comprises user-dependent information and the action type corresponding with user.

Public virtual machine refers to the virtual machine of user in dummy machine system; This device section is deployed between public virtual machine and storage system, and for the raw data of public virtual machine access storage system provides optimization, public virtual machine is by this device access storage system; The operating system mirror image of public virtual machine leaves the operating system mirror image space of storage system in, and the scratch diskette of each public virtual machine is mapped to the data space in storage system by NAS.

The action type that judge module 102 comprises for the data access request received according to the first receiver module 101, judges whether the data of data access request institute request access are the data with access rights attribute.

Authority determination module 103 is for being when being the data with access rights attribute in the judged result of judge module 102, according to the metadata corresponding with the data of request access stored in local internal memory, determine whether data access request has the authority of access, wherein, metadata comprises user-dependent information and the action type corresponding with user, and the metadata stored in local internal memory loads from storage system.

Can transmission information mutually between this device and storage system, therefore, this device can metadata in load store system, and is kept in local internal memory.The detailed process loaded can be: after private virtual machine starts, issue broadcast message, after storage system receives broadcast message, set up with this private virtual machine and contact, the IP address at metadata place in storage system is sent to private virtual machine, and private virtual machine passes through this IP address metadata about load from storage system, after having loaded, carry out IP address switchover, private virtual machine is using the IP address of this IP address as oneself.Therefore, object is that the data access request of this IP address is transferred to this private virtual machine from storage system.

When the data of data access request institute request access are the data with access rights attribute, if and store the metadata corresponding with the data of request access in local internal memory, then can determine whether data access request has the authority of access according to the user-dependent information in the user-dependent information of this metadata and the action type corresponding with user, data access request and the action type corresponding with user.

When allowing access modules 104 to have an authority of access for determining data access request at authority determination module 103, public virtual machine is allowed to be accessed the raw data stored in storage system by this device itself.

If data access request has the authority of access, so this device can allow the raw data of public virtual machine by storing in this device access storage system itself.That is, if data access request has the authority of access, so private virtual machine obtains raw data from storage system, and sends to public virtual to intend machine.

Embodiment of the present invention receives the data access request from public virtual machine, and with the raw data in request access storage system, data access request comprises user-dependent information and the action type corresponding with user; According to action type, judge whether the data of data access request institute request access are the data with access rights attribute; If, then according to the metadata corresponding with the data of request access stored in local internal memory, determine whether data access request has the authority of access, wherein, metadata comprises user-dependent information and the action type corresponding with user, and the metadata stored in local internal memory is that device loads from storage system; If data access request has the authority of access, then allow the raw data of public virtual machine by storing in this device access storage system.Load and next metadata from storage system owing to storing in local internal memory, thus a large amount of metadata operations is concentrated on this locality carry out, reduce the pressure to storage system, and accelerate authenticated user accesses, minimizing is repeatedly mutual with network, reduces overall access time delay.

In one embodiment, device also comprises: load-on module 105, address switchover module 106.

With there be the raw data of the access rights corresponding metadata of load-on module 105 in load store system.

Address switchover module 106 is for after the metadata that load-on module loading is corresponding with there being the raw data of access rights, be an IP address by the IP address substitution of this locality, and notify that its IP address substitution is a non-IP address by storage system, wherein, an IP address is the IP address of storage system before replacing.

After the metadata corresponding with there being the raw data of access rights in this device load store system, originally the IP address being storage system is taken, being about to local IP address substitution is an IP address, notifies that storage system changes the non-IP address that IP address is other simultaneously.After one IP address of storage system is occupied, the request of access of relevant access storage system is automatically handed on private virtual machine, thus shares the pressure of storage system.

See Fig. 6, in one embodiment, device also comprises: the first acquisition module 107.

First acquisition module 107 is for when the data of request access are the data with access rights attribute, and when not having in local internal memory to store the metadata corresponding with the data of request access, obtain the metadata corresponding with the data of request access by FileRPC agreement from storage system.

With the data of the request access corresponding metadata of authority determination module 103 also for obtaining according to the first acquisition module 107, determines whether data access request has the authority of access.

In another embodiment, device also comprises: the second receiver module 108.

Second receiver module 108 is for receiving the call back message from storage system, and the metadata that call back message notifying device changes, so that device carries out crash handling to the metadata changed.

In yet, device also comprises: the second acquisition module 109.

Second acquisition module 109, for the operating habit according to public virtual machine, obtains metadata corresponding to data that public virtual machine will access by FileRPC agreement from storage system in advance.

If the operating habit of this device to public virtual machine is known, so private virtual machine can obtain metadata corresponding to data that public virtual machine will access by FileRPC agreement from storage system in advance.Such as: private virtual machine can add up the data of public virtual machine access, thus obtains some operating habit of public virtual machine; If public virtual machine A is after visit data 1, inevitable visit data 2, so at public virtual machine A visit data 1, and private virtual machine this locality is not when having a metadata of data 2 correspondence, private virtual machine can obtain the metadata corresponding to data 2 from storage system in advance so that private virtual machine to be public virtual machine A ready by the metadata of visit data 2 correspondence.In this way, access can be accelerated further, reduce time delay.

Embodiment of the present invention receives the data access request from public virtual machine, and with the raw data in request access storage system, data access request comprises user-dependent information and the action type corresponding with user; According to action type, judge whether the data of data access request institute request access are the data with access rights; If, then according to the metadata corresponding with the data of request access stored in local internal memory, determine whether data access request has the authority of access, wherein, metadata comprises user-dependent information and the action type corresponding with user, and the metadata stored in local internal memory is that device loads from storage system; If data access request has the authority of access, then allow the raw data of public virtual machine by storing in this device access storage system.Load and next metadata from storage system owing to storing in local internal memory, thus a large amount of metadata operations is concentrated on this locality carry out, reduce the pressure to storage system, and accelerate authenticated user accesses, minimizing is repeatedly mutual with network, reduces overall access time delay.

Consult Fig. 7, Fig. 7 is the entity apparatus structural representation of device one embodiment of visit data of the present invention, the virtual hard disk of public virtual machine maps within the storage system, described device section is deployed between public virtual machine and storage system, public virtual machine asks storage system by this device, and can transmission information mutually between described device and described storage system, described device is the entity apparatus of the device of above-mentioned Fig. 5 to Fig. 8.Described device comprises: receiver 11, processor 12, the storer 13 be coupled with processor 12 and the connecting line 14 being connected receiver 11, storer 13, processor 12.

Receiver 11 is for receiving the data access request from public virtual machine, and with the raw data in request access storage system, described data access request comprises user-dependent information and the action type corresponding with described user.

The data access request that storer 13 receives for storing receiver 11, loads and next metadata from described storage system for storing.

The data access request that processor 12 stores for transferring described storer 13, according to the described action type that described data access request comprises, judges whether the data of described data access request institute request access are the data with access rights attribute; Be when being the data with access rights attribute in judged result, according to the metadata corresponding with the data that described request is accessed stored in local internal memory, determine whether described data access request has the authority of access, wherein, described metadata comprises user-dependent information and the action type corresponding with described user; When described data access request has the authority of access, described public virtual machine is allowed to be accessed in described storage system the described raw data stored by this device.

Processor 12 is also for loading the metadata corresponding with there being the raw data of access rights in described storage system; After the described metadata loaded corresponding with there being the raw data of access rights, be an IP address by the IP address substitution of this locality, and notify that its IP address substitution is a non-IP address by described storage system, wherein, a described IP address is the IP address of described storage system before replacing.

Processor 12 is also for being when being the data with access rights attribute in judged result, and do not have in local internal memory to store the metadata corresponding with the data that described request is accessed, then obtain the metadata corresponding with the data that described request is accessed by FileRPC agreement from described storage system, and according to the metadata corresponding with the data that described request is accessed obtained, determine whether described data access request has the authority of access.

Receiver 11 is also for receiving the call back message from described storage system, and described call back message notifies the metadata that described private virtual machine changes, so that described private virtual machine carries out crash handling to the described metadata changed.

Processor 12, also for the operating habit according to described public virtual machine, obtains metadata corresponding to data that described public virtual machine will access by FileRPC agreement from described storage system in advance.

See Fig. 8, Fig. 8 is the structural representation of system one embodiment of visit data of the present invention, comprise at least one server 100, at least one storage system 200, wherein, described server 100 is provided with at least one public virtual machine 1001, at least one private virtual machine 1002 and virtual machine manager Hypervisor1003.

Wherein, the virtual hard disk of public virtual machine 1001 is mapped in storage system 200, private virtual machine 1002 is deployed between public virtual machine 1001 and storage system 200, public virtual machine 1001 accesses storage system 200 by private virtual machine 1002, and can transmission information mutually between private virtual machine 1002 and storage system 200.

Wherein, private virtual machine 1002 receives the data access request from public virtual machine 1001, and with the raw data in request access storage system 200, described data access request comprises user-dependent information and the action type corresponding with described user; According to the described action type that described data access request comprises, judge whether the data of described data access request institute request access are the data with access rights attribute; Be when being the data with access rights attribute in judged result, according to the metadata corresponding with the data that described request is accessed stored in local internal memory, determine whether described data access request has the authority of access, wherein, described metadata comprises user-dependent information and the action type corresponding with described user; When described data access request has the authority of access, allow the described raw data of described public virtual machine 1001 by storing in the described storage system 200 of private virtual machine 1002 access itself.

Wherein, private virtual machine 1002 loads the metadata corresponding with there being the raw data of access rights in described storage system 200; After the described metadata loaded corresponding with there being the raw data of access rights, be an IP address by the IP address substitution of this locality, and notify that its IP address substitution is a non-IP address by described storage system 200, wherein, a described IP address is the IP address of described storage system 200 before replacing.

Wherein, private virtual machine 1002 is when being the data with access rights attribute in judged result, and do not have in local internal memory to store the metadata corresponding with the data that described request is accessed, then obtain the metadata corresponding with the data that described request is accessed by FileRPC agreement from described storage system 200, and according to the metadata corresponding with the data that described request is accessed obtained, determine whether described data access request has the authority of access.

Wherein, private virtual machine 1002 receives the call back message from described storage system 200, described call back message notifies the metadata that described private virtual machine 1002 changes, so that described private virtual machine 1002 carries out crash handling to the described metadata changed.

Wherein, private virtual machine 1002, according to the operating habit of described public virtual machine 1001, obtains metadata corresponding to data that described public virtual machine 1001 will access by FileRPC agreement from described storage system 200 in advance.

Wherein, storage system 200 is with the process of private virtual machine 1002 transmission information, detect that private virtual machine 1002 does not respond in the given time, then the IP address at the I/O request corresponding data place of issuing private virtual machine 1002 is changed to the IP address of storage system 200 by storage system 200 automatically, is transferred directly in storage system 200 to make the data access of public virtual machine 1001.

Be the process flow diagram of the another embodiment of method of visit data of the present invention see Fig. 9, Fig. 9, present embodiment is the method flow diagram of storage system side.Wherein, the virtual hard disk of public virtual machine maps within the storage system, and private virtual machine is deployed between public virtual machine and storage system, and public virtual machine is by private virtual machine access storage system, and can transmission information mutually between private virtual machine and storage system, the method comprises:

Step S301: storage system receives the request that there be the raw data of access rights of public virtual machine by storing in private virtual machine access storage system, wherein, the request of the raw data of access rights that has stored in access storage system is that private virtual machine sends to storage system when private virtual machine judges that the data access request of publicly-owned virtual machine has an authority of access.

Step S302: storage system obtains raw data from the virtual hard disk being mapped in local public virtual machine.

Step S303: raw data is sent to public virtual machine by private virtual machine by storage system.

Embodiment of the present invention storage system receives the request that there be the raw data of access rights of public virtual machine by storing in private virtual machine access storage system, wherein, the request of the raw data of access rights that has stored in access storage system is that private virtual machine sends to storage system when private virtual machine judges that the data access request of publicly-owned virtual machine has an authority of access; Storage system obtains raw data from the virtual hard disk being mapped in local public virtual machine; Raw data is sent to public virtual machine by private virtual machine by storage system.Because the request of the raw data of access rights that has stored in access storage system is when private virtual machine judges that the data access request of publicly-owned virtual machine has an authority of access, private virtual machine sends to storage system, thus a large amount of metadata operations is concentrated on private virtual machine carry out, reduce the pressure to storage system, and acceleration authenticated user accesses, minimizing is repeatedly mutual with network, reduces overall access time delay.

Be the process flow diagram of the another embodiment of method of visit data of the present invention see Figure 10, Figure 10, present embodiment is the method flow diagram of storage system side.

Particularly, before step S301, also comprise:

Step S304: storage system receives the request that private virtual machine loads the metadata corresponding with there being the raw data of access rights.

Step S305: storage system obtains and is kept at local, corresponding with there being the raw data of access rights metadata, and metadata is sent to private virtual machine.

Step S306: storage system receives the IP address change notice of private virtual machine, and own IP address is replaced by a non-IP address, wherein, an IP address is the IP address of storage system before replacing.

After the metadata corresponding with there being the raw data of access rights in private virtual machine load store system, the IP address being originally storage system being taken, notifying that storage system changes the non-IP address that IP address is other simultaneously.After one IP address of storage system is occupied, the request of access of relevant access storage system is automatically handed on private virtual machine, and regarding metadata operation concentrates on private virtual machine and carries out, thus shares the pressure of storage system.

Wherein, the method also comprises: when there being metadata corresponding to the raw data of access rights to change, storage system sends call back message to private virtual machine, the metadata that call back message notice private virtual machine changes, so that private virtual machine carries out crash handling to the metadata changed.

Wherein, the method also comprises: if storage system is with the process of private virtual machine transmission information, detect that private virtual machine does not respond in the given time, then storage system becomes the IP address of self again an IP address automatically, is transferred directly in storage system to make the data access of public virtual machine.

See the structural representation that Figure 11, Figure 11 are storage system one embodiments of the present invention, the storage system of present embodiment can perform corresponding step in the method for above-mentioned storage system side.In the present embodiment, the virtual hard disk of public virtual machine maps within the storage system, private virtual machine is deployed between public virtual machine and storage system, and public virtual machine, and can transmission information mutually between private virtual machine and storage system by private virtual machine access storage system.Storage system comprises: the first receiver module 201, first acquisition module 202 and the first sending module 203.

First receiver module 201 is for the request that have the raw data of access rights of public virtual machine by storing in private virtual machine access storage system, wherein, the request of the raw data of access rights that has stored in access storage system is that private virtual machine sends to storage system when private virtual machine judges that the data access request of publicly-owned virtual machine has an authority of access.

First acquisition module 202 for obtaining raw data from the virtual hard disk being mapped in local public virtual machine.

First sending module 203 is for sending to public virtual machine by raw data by private virtual machine.

See Figure 12, storage system also comprises: the second receiver module 204, second acquisition module 205, second sending module 206 and the first address switchover module 207.

Second receiver module 204 loads the request of the metadata corresponding with there being the raw data of access rights for receiving private virtual machine.

Second acquisition module 205 is kept at local, corresponding with there being the raw data of access rights metadata for obtaining.

Second sending module 206 is for sending to private virtual machine by metadata.

First address switchover module 207 is for receiving the IP address change notice of private virtual machine, and own IP address is replaced by a non-IP address, wherein, an IP address is the IP address of storage system before replacing.

Wherein, storage system also comprises the 3rd sending module.

3rd sending module is used for when there being metadata corresponding to the raw data of access rights to change, call back message is sent to private virtual machine, the metadata that call back message notice private virtual machine changes, so that private virtual machine carries out crash handling to the metadata changed.

Wherein, storage system also comprises the second address switchover module.

Second address switchover module is used in storage system with the process of private virtual machine transmission information, when detecting that private virtual machine does not respond in the given time, automatically become the IP address of self again an IP address, be transferred directly in storage system to make the data access of public virtual machine.

In several embodiment provided by the present invention, should be understood that, disclosed system, apparatus and method, can realize by another way.Such as, device embodiments described above is only schematic, such as, the division of described module or unit, be only a kind of logic function to divide, actual can have other dividing mode when realizing, such as multiple unit or assembly can in conjunction with or another system can be integrated into, or some features can be ignored, or do not perform.Another point, shown or discussed coupling each other or direct-coupling or communication connection can be by some interfaces, and the indirect coupling of device or unit or communication connection can be electrical, machinery or other form.

The described unit illustrated as separating component or can may not be and physically separates, and the parts as unit display can be or may not be physical location, namely can be positioned at a place, or also can be distributed in multiple network element.Some or all of unit wherein can be selected according to the actual needs to realize the object of present embodiment scheme.

In addition, each functional unit in each embodiment of the present invention can be integrated in a processing unit, also can be that the independent physics of unit exists, also can two or more unit in a unit integrated.Above-mentioned integrated unit both can adopt the form of hardware to realize, and the form of SFU software functional unit also can be adopted to realize.

If described integrated unit using the form of SFU software functional unit realize and as independently production marketing or use time, can be stored in a computer read/write memory medium.Based on such understanding, the part that technical scheme of the present invention contributes to prior art in essence in other words or all or part of of this technical scheme can embody with the form of software product, this computer software product is stored in a storage medium, comprising some instructions in order to make a computer equipment (can be personal computer, server, or the network equipment etc.) or processor (processor) perform all or part of step of method described in each embodiment of the present invention.And aforesaid storage medium comprises: USB flash disk, portable hard drive, ROM (read-only memory) (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disc or CD etc. various can be program code stored medium.

The foregoing is only embodiments of the present invention; not thereby the scope of the claims of the present invention is limited; every utilize instructions of the present invention and accompanying drawing content to do equivalent structure or equivalent flow process conversion; or be directly or indirectly used in other relevant technical fields, be all in like manner included in scope of patent protection of the present invention.

Claims

1. the method for a visit data, it is characterized in that, the virtual hard disk of public virtual machine maps within the storage system, private virtual machine is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described private virtual machine, and can transmission information mutually between described private virtual machine and described storage system, described method comprises:

Private virtual machine receives the data access request from public virtual machine, and with the raw data in request access storage system, described data access request comprises user-dependent information and the action type corresponding with described user;

Described private virtual machine, according to described action type, judges whether the data of described data access request institute request access are the data with access rights attribute;

If, then described private virtual machine is according to the metadata corresponding with the data that described request is accessed stored in local internal memory, determine whether described data access request has the authority of access, wherein, described metadata comprises user-dependent information and the action type corresponding with described user, and the metadata stored in described local internal memory is that described private virtual machine loads from described storage system;

If described data access request has the authority of access, then described private virtual machine allows the described raw data of described public virtual machine by storing in the described storage system of described private virtual machine access itself.

2. method according to claim 1, is characterized in that, described private virtual machine receives the data access request from public virtual machine, before the step of the raw data in request access storage system, comprising:

Described private virtual machine loads the metadata corresponding with there being the raw data of access rights in described storage system;

After the described metadata loaded corresponding with there being the raw data of access rights, the IP address substitution of this locality is an IP address by described private virtual machine, and notify that its IP address substitution is a non-IP address by described storage system, wherein, a described IP address is the IP address of described storage system before replacing.

3. method according to claim 1 and 2, is characterized in that, described private virtual machine, according to described action type, after judging whether data that described request is accessed are the step of the data with access rights attribute, comprising:

If have the data of access rights attribute, and do not have in the local internal memory of described private virtual machine to store the metadata corresponding with the data that described request is accessed, then described private virtual machine obtains the metadata corresponding with the data that described request is accessed by FileRPC agreement from described storage system, and according to the metadata corresponding with the data that described request is accessed obtained, determine whether described data access request has the authority of access.

4. method according to claim 1, is characterized in that, described method also comprises:

Described private virtual machine receives the call back message from described storage system, and described call back message notifies the metadata that described private virtual machine changes, so that described private virtual machine carries out crash handling to the described metadata changed.

5. the method according to any one of claim 1-4, is characterized in that, described method also comprises:

Described private virtual machine, according to the operating habit of described public virtual machine, obtains metadata corresponding to data that described public virtual machine will access by FileRPC agreement from described storage system in advance.

6. the device of a visit data, it is characterized in that, the virtual hard disk of public virtual machine maps within the storage system, described device section is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described device, and can transmission information mutually between described device and described storage system, described device comprises: the first receiver module, judge module, authority determination module and allow access modules;

Described first receiver module is for receiving the data access request from public virtual machine, and with the raw data in request access storage system, described data access request comprises user-dependent information and the action type corresponding with described user;

The described action type that the data access request that described judge module is used for receiving according to described first receiver module comprises, judges whether the data of described data access request institute request access are the data with access rights attribute;

It is when being the data with access rights attribute that described authority determination module is used in the judged result of described judge module, according to the metadata corresponding with the data that described request is accessed stored in local internal memory, determine whether described data access request has the authority of access, wherein, described metadata comprises user-dependent information and the action type corresponding with described user, and the metadata stored in described local internal memory loads from described storage system;

Described permission access modules is used for, when described authority determination module determines that described data access request has an authority of access, allowing described public virtual machine to access in described storage system the described raw data stored.

7. device according to claim 6, is characterized in that, described device also comprises: load-on module, address switchover module;

Described load-on module is for loading the metadata corresponding with there being the raw data of access rights in described storage system;

Described address switchover module is used for after described load-on module loads described corresponding with there being the raw data of access rights metadata, be an IP address by the IP address substitution of this locality, and notify that its IP address substitution is a non-IP address by described storage system, wherein, a described IP address is the IP address of described storage system before replacing.

8. the device according to claim 6 or 7, is characterized in that, described device also comprises: the first acquisition module,

Described first acquisition module is used for when the data of described request access are the data with access rights attribute, and when not having in local internal memory to store the metadata corresponding with the data that described request is accessed, obtain the metadata corresponding with the data that described request is accessed by FileRPC agreement from described storage system;

With data that described request the access corresponding metadata of described authority determination module also for obtaining according to described first acquisition module, determines whether described data access request has the authority of access.

9. device according to claim 6, is characterized in that, described device also comprises: the second receiver module,

Described second receiver module is for receiving the call back message from described storage system, and described call back message notifies the metadata that described device changes, so that described device carries out crash handling to the described metadata changed.

10. the device according to any one of claim 6-9, is characterized in that, described device also comprises: the second acquisition module,

Described second acquisition module is used for according to the operating habit of described public virtual machine, obtains metadata corresponding to data that described public virtual machine will access in advance by FileRPC agreement from described storage system.

The device of 11. 1 kinds of visit datas, it is characterized in that, the virtual hard disk of public virtual machine maps within the storage system, described device section is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described device, and can transmission information mutually between described device and described storage system, described device comprises: receiver, processor, the storer be coupled with processor;

Described receiver is for receiving the data access request from described public virtual machine, and with the raw data in storage system described in request access, described data access request comprises user-dependent information and the action type corresponding with described user;

The data access request that described storer receives for storing described receiver, loads and next metadata from described storage system for storing;

The data access request that described processor stores for transferring described storer, according to the described action type that described data access request comprises, judges whether the data of described data access request institute request access are the data with access rights attribute; Be when being the data with access rights attribute in judged result, according to the metadata corresponding with the data that described request is accessed stored in local internal memory, determine whether described data access request has the authority of access, wherein, described metadata comprises user-dependent information and the action type corresponding with described user; When described data access request has the authority of access, described public virtual machine is allowed to be accessed in described storage system the described raw data stored by described device.

The system of 12. 1 kinds of visit datas, is characterized in that, described system comprises at least one server, at least one storage system, and described server is provided with at least one public virtual machine, at least one private virtual machine; The virtual hard disk of described public virtual machine maps within the storage system, described private virtual machine is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described private virtual machine, and can transmission information mutually between described private virtual machine and described storage system;

Wherein, described private virtual machine receives the data access request from described public virtual machine, and with the raw data in storage system described in request access, described data access request comprises user-dependent information and the action type corresponding with described user; According to the described action type that described data access request comprises, judge whether the data of described data access request institute request access are the data with access rights attribute; Be when being the data with access rights attribute in judged result, according to the metadata corresponding with the data that described request is accessed stored in local internal memory, determine whether described data access request has the authority of access, wherein, described metadata comprises user-dependent information and the action type corresponding with described user; When described data access request has the authority of access, allow the raw data of described public virtual machine by storing in the described storage system of private virtual machine access itself.

The method of 13. 1 kinds of visit datas, it is characterized in that, the virtual hard disk of public virtual machine maps within the storage system, private virtual machine is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described private virtual machine, and can transmission information mutually between described private virtual machine and described storage system, described method comprises:

Storage system is received public virtual machine and is accessed the request having the raw data of access rights stored in described storage system by private virtual machine, wherein, the request of the raw data of access rights that has stored in described access storage system is that described private virtual machine sends to described storage system when described private virtual machine judges that the data access request of described publicly-owned virtual machine has an authority of access;

Described storage system obtains described raw data from the virtual hard disk being mapped in local described public virtual machine;

Described raw data is sent to described public virtual machine by described private virtual machine by described storage system.

14. methods according to claim 13, is characterized in that, described storage system receives before public virtual machine accesses the step of the request of the raw data stored in described storage system by private virtual machine, comprising:

Described storage system receives described private virtual machine and loads the request with the described metadata having the raw data of access rights corresponding;

Described storage system obtain be kept at local, with the described metadata having the raw data of access rights corresponding, and described metadata is sent to described private virtual machine;

Described storage system receives the IP address change notice of described private virtual machine, and own IP address is replaced by a non-IP address, wherein, a described IP address is the IP address of described storage system before replacing.

15. methods according to claim 13, is characterized in that, described method also comprises:

When described have metadata corresponding to the raw data of access rights to change time, described storage system sends call back message to described private virtual machine, described call back message notifies the metadata that described private virtual machine changes, so that described private virtual machine carries out crash handling to the described metadata changed.

16. methods according to claim 14, is characterized in that, described method also comprises:

If described storage system is with the process of described private virtual machine transmission information, detect that described private virtual machine does not respond in the given time, then described storage system becomes the IP address of self again a described IP address automatically, is transferred directly in described storage system to make the data access of described public virtual machine.

17. 1 kinds of storage systems, it is characterized in that, the virtual hard disk of public virtual machine maps within the storage system, private virtual machine is deployed between described public virtual machine and described storage system, described public virtual machine accesses described storage system by described private virtual machine, and can transmission information mutually between described private virtual machine and described storage system, described storage system comprises: the first receiver module, the first acquisition module and the first sending module;

Described first receiver module is used for public virtual machine and is accessed the request having the raw data of access rights stored in described storage system by private virtual machine, wherein, the request of the raw data of access rights that has stored in described access storage system is that described private virtual machine sends to described storage system when described private virtual machine judges that the data access request of described publicly-owned virtual machine has an authority of access;

Described first acquisition module is used for obtaining described raw data from the virtual hard disk being mapped in local described public virtual machine;

Described first sending module is used for described raw data to send to described public virtual machine by described private virtual machine.

18. storage systems according to claim 17, is characterized in that, described storage system also comprises: the second receiver module, the second acquisition module, the second sending module and the first address switchover module;

Described second receiver module loads the request with the described metadata having the raw data of access rights corresponding for receiving described private virtual machine;

Described second acquisition module for obtain be kept at local, with the described metadata having the raw data of access rights corresponding;

Described second sending module is used for described metadata to send to described private virtual machine;

Described first address switchover module is for receiving the IP address change notice of described private virtual machine, and own IP address is replaced by a non-IP address, wherein, a described IP address is the IP address of described storage system before replacing.

19. storage systems according to claim 17, is characterized in that, described storage system also comprises the 3rd sending module,

Described 3rd sending module be used for when described in have metadata corresponding to the raw data of access rights to change time, call back message is sent to described private virtual machine, described call back message notifies the metadata that described private virtual machine changes, so that described private virtual machine carries out crash handling to the described metadata changed.

20. storage systems according to claim 18, is characterized in that, described storage system also comprises the second address switchover module,

Described second address switchover module is used in described storage system with the process of described private virtual machine transmission information, when detecting that described private virtual machine does not respond in the given time, automatically become the IP address of self again a described IP address, be transferred directly in described storage system to make the data access of described public virtual machine.