JP3274151B2 - Distributed file system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

 [Object of the invention]

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a distributed file system in a network system composed of a plurality of computer systems connected via a communication medium.

[0002]

2. Description of the Related Art Conventionally, in a network system in which a plurality of computer systems (hereinafter referred to as nodes) are connected via a communication medium, each node can access the file system by an operation of "mounting" the file system. Can be In addition, each node can mutually mount the file system of the remote node via a communication medium, and can also access the file system as if it were a local file system. Mounting via a communication medium is called "remote mounting"). That is, by setting a local file system name that may be mounted on another remote node via a communication medium by one node on the network, the other remote node can set the file set to be mounted on the other remote node. The system can be remotely mounted, and the remotely mounted file system can be accessed as if it were a local file system (hereinafter, some or all of the local file system is remotely mounted on other nodes). This is referred to as "exporting" a file system, the node on the export side is referred to as a "server node", and the node on the remote mount side is referred to as a "client node". At that time, according to the conventional technology, the server node performs a

[0003] (1) A remote node on which the file system may be mounted. (2) Whether the file system is exported so that it can be read only or whether it can be read and written. (3) On the server node. Undefined users (hereinafter, users
Say the user. ) , The request is rejected or given to the username identifying the user
The internal code (hereinafter, referred to as a user identifier) is
Or treatment accepted by regarding a particular user identifier for definition of the user (4) A It is possible to perform the specified whether to reject or accept the access request as a super user (user with the privilege of almighty) Was. The server node has an "export information file" to perform the above specification for the file system to be exported.

However, since each node accesses a file system that has been remotely mounted once in the same manner as a local file system, when remotely mounting a file system, a server node and a client node are required. It was necessary that the assignment of the user name and the user identifier was synchronized between the two. If the assignment of the username and user identifier is not synchronized between the server node and the client node,
Unauthorized use, destruction,
Or there was a security problem such as eavesdropping.

For example, as shown in FIG. 4, when a user identifier of 1 is assigned to a user a on a server node and a user b on a client node, respectively,
It can be said that the assignment of the user name and the user identifier is not synchronized. At this time, a file owned by the user a on the server node has an attribute that the file owner is the user identifier 1. Therefore, on the client node on which the file system including this file is remotely mounted, the file is owned by the user b who is the user with the user identifier 1 on the client node, and as a result, the user b on the client node is remotely mounted. All the files of the user a on the server node that has been used can be handled freely.

[0006]

As described above, a file system to be exported specifies a node that can be remotely mounted, denies only a write access request, and denies an access request as a superuser. , and undefined user on the server node
It is possible to refuse requests from users, but the control on access requests of any user except the superuser and undefined user once to a remotely mounted file system is the same as that of a local file system. Was being processed. That is, the access request to the file, the target file in full <br/> § filesystem on the file the file is are either the same manner with the user identifier user having issued request falls requested regardless with the local Acceptance or rejection procedures were based solely on the relationship with the attributes of a file. For this reason, user names and user names are
A problem occurs when the assignment of the identifier is not synchronized, and there is a security problem such as unauthorized use, destruction, or eavesdropping of the exported file system.

Therefore, for example, when a plurality of networks whose user names and user identifiers are not synchronized are connected to each other and it is desired to share a file system by remote mounting between the networks, for example, Therefore, a large-scale operation such as reassigning a new user identifier and synchronizing the user name and the user identifier on all the networks is required.

The present invention has been made in view of the above circumstances, and has means for controlling an access request from a remote node to an exported file system by a requesting node, a user identifier, and an access type. This makes it possible to provide fine-grained access control of the exported file system, and to provide a distributed file system with improved security regardless of whether the user name and user identifier between nodes are synchronous or asynchronous in a distributed processing system. Aim. [Configuration of the Invention]

[0009]

In order to achieve the above object, the present invention provides a distributed processing system in which a plurality of nodes are connected via a communication medium when a file system is exported to a remote node. , What kind of access to that exported file system from which node, from which user identifier (read only,
Or read and write) is accepted or rejected, and based on the designation, in response to an access request from a remote node to the exported file system, the name of the node that issued the request, By providing a means for checking the user identifier and the type of access to determine acceptance or rejection of the access request, it is possible to restrict access from a remote node to the exported file system to a specific user, User between nodes on the network by
It is possible to provide a distributed file system with improved stability regardless of whether the name and the user identifier are synchronous or asynchronous.

[0010]

An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a diagram showing a configuration of a distributed processing system according to an embodiment of the present invention. As shown in the figure, the system includes nodes 2a, 2b,
2c ..., and this node 2
Terminal devices 3a, 3b, 3c,... Each comprising a CRT display for displaying information and a keyboard for inputting commands and the like.
・ Local file systems 4a, 4b, which store information
4c ... are connected. Further, in each local file system 4, there exist export information files 5a, 5b, 5c,... Which specify information of a file system to be exported for each node. The export information file 5 clearly specifies (a) the name of the local file system to be exported, and (b) mount the file system as a conventional option for each of the file systems to be exported in (a) above. A good remote node name (c) export the file system read-only or read-write (d) deny access requests from undefined usernames on the server node Or as a specific user identifier, and, as an option of the present invention, (e) accepting or rejecting which type of access request from which node, from which user name , Is clearly specified. The information of these export information files 5 is
Some privileged users (superusers and the like) managing each node from the terminal device 3 can make corrections and changes at any time.

Here, one description method of the export information file 5 will be described. Each entry for the file system to be exported is configured as follows. File system name-option [,-option] ...

That is, first, the name of the file system to be exported is specified, and then the option is specified. Multiple options are separated by commas (,). The following options are available.

ND: an option for designating a node name on which the file system may be remotely mounted. Specify the node name after =. You can specify multiple node names by separating them with:. If this option is omitted, it means that all nodes can be remotely mounted.

RO: an option indicating that the file system is to be exported so that it can be read only. If this option is omitted, it means to export the file system so that it can be read and written.

UK: Request from undefined user identifier =
An option that specifies to treat as the specified user identifier following the. If this option is omitted, it means that requests from undefined user identifiers will be rejected.

Root: An option indicating that an access request as a super user is accepted. If this option is omitted, it means that the access request from the superuser is rejected. Rw: an option that specifies a user identifier that can be read or written.

A user identifier is specified after = or! =, And then a node name is specified after @. You can specify multiple user identifiers and node names separated by:. If the designation of the node name is omitted, it is assumed that all nodes have been designated.

A user identifier + node name specified after = means that, in response to an access request from the specified node, only read and write access to the request for the specified user identifier is accepted.

The user identifier and node name specified after! = Mean that both read and write accesses are accepted for only requests other than the specified user identifier in response to an access request from the specified node. -Ro: an option to specify a user identifier that may or may not be read only.

A user identifier is specified after = or! =, And then a node name is specified after @. You can specify multiple user identifiers and node names separated by:. If designation of user identifiers is omitted, it is assumed that all user identifiers have been designated. If the designation of the node name is omitted, it is assumed that all nodes have been designated.

The user identifier and node name specified after = means that, in response to an access request from the specified node, only a request for the specified user identifier and read-only access are accepted.

The user identifier and node name specified after! = Means that only read requests other than the specified user identifier are accepted for access requests from the specified node.

Each node 2 also determines whether a file system access request is a request for a local file system or a request for a mounted remote file system.
6a, 6b, 6c,... And a remote access request determination procedure section 7a, 7b, 7c, which determines whether to accept or reject an access request from the remote node to the exported file system based on the information in the export information file 5.
And remote file information 8a, 8b, 8c,... Indicating information of a remotely mounted file system. Based on the export information file 5, it is determined whether (1) reception or rejection when a remote mount request is received from another node, and (2) reception or rejection of an access request from a remote node to an exported file system. I do. The present invention enhances the function (2), that is, control of access requests from remote nodes to the exported file system.

For example, it is assumed that a description as shown in FIG. 3 is made in the export information file 5a of the node 2a. Here, it is assumed that the node 2b remotely mounts the file system / dir1 of the node 2a. The node 2b transfers the remote mount request to that effect to the node 2a via the communication medium. When the node 2a receives the remote mount request from the node 2b, it checks the export information file 5a. As shown in FIG. 4, in the export information file 5a, the file system / dir
1 means that the option ND is omitted, so remote mounting is possible from all nodes. Accordingly, the remote mount request of the node 2b is accepted, and the node 2b can remotely mount the file system / dir1 of the node 2a.

Next, the state where the node 2b has remotely mounted the file system / dir1 of the node 2a as described above,
That is, in a state where the node 2a is a server node and the node 2b is a client node, the operation of the above configuration will be described with reference to the flowchart shown in FIG.

Here, an access request to the file system is generated in the node 2b (step S1). The access request includes, as information, the name of the node that issued the access (in this case, node 2b), the identifier of the user who issued the access, the name of the file to be accessed, and the type of access. On the other hand, the local access request determination procedure unit 6b checks the remote mount information 8b from the access target file name, which is information of the access request, and determines whether the access request is an access request to the local file system 4b or Mounted node
It is determined whether the access request is for the file system 4a of 2a (step S2). Since the remote mount information 8b describes which file belongs to the remotely mounted file system of which node, it can be determined from the target file name whether the file is a file of the remotely mounted file system or not. . In the case of a request to access the local file system 4b, the request is directed to the target local file, and is processed according to the relationship between the attribute of the target file and the identifier of the user who issued the access request (step S3). In other words, the target file has the following attributes: • file owner identifier • file group identifier • whether access requests (read, write, execute) from the owner user are permitted or not • access from group-affiliated users Whether each request (read, write, execute) is permitted or not ・ Whether each user's access request (read, write, execute) is permitted or not, the access request is issued based on that Depending on the user identifier and the type of access, the access is accepted or rejected.

On the other hand, when it is determined from the remote mount information 8b that the access request is for the file system of the remotely mounted node 2a, the request is transferred to the remote node 2a via the communication medium 1 (step S4). When the transferred access request is received by the remote access request determination procedure unit 7a, the export information file 5a
Is checked (step S5). The export information file 5a describes which type of access request from which user of which node should be accepted or rejected. Therefore, based on the information of the export information file and the information of the access request, Thus, it can be determined whether the access request is to be accepted or rejected.

For example, at this time, in the export information file 5a of the node 2a, as shown in FIG. 3, the access request from the remote node to the exported local file system / dir1 includes the user identifier 1 from the node 2b, It describes that only request 2 is accepted for both reading and writing. Here, when the access request from the node 2b is issued by the user with the user identifier 1, the request is accepted based on the description of the export information file 5a, and thereafter, the access from the local node is performed. Like the request, the processing is performed based on the relationship between the attribute of the target file and the identifier of the user who issued the request. On the other hand, when the access request from the node 2b is issued by the user with the user identifier 3,
Since the user is not described in the export information file 5a, the request is rejected regardless of the relationship between the attribute of the target file and the user identifier, and a response to that effect is transferred to the node 2b via the communication medium, and the CRT Display 3b
(Step S6).

As described above, since the access request from the node 2b to the file system / dir1 of the remotely mounted node 2a from the user other than the user identifiers 1 and 2 is rejected, the requests of the nodes 2a and 2b are rejected. Between,
Even if user identifiers other than 1 and 2 are not synchronized, unauthorized access to / dir1 is prevented. Similarly,
Unauthorized access to the file system / dir1 from another node (for example, 2c) is also prevented.

According to the above-described procedure, an access request from the client node to the exported file system can be controlled by the requesting node, the user identifier, and the type of access, and the security of the exported file system can be reduced. improves.

[0032]

As described above in detail, according to the distributed file system of the present invention, not only a node which can remotely mount a file system to be exported, but also a user identifier which can access the file system is requested. Can be specified in combination with the name of the node issuing the command and the type of access (read only or read / write), so that access control of the exported file system can be finely controlled. In addition, since the user identifiers that can access the exported file system can be limited to a part, it is not necessary to synchronize the assignment of all user identifiers between the server node and the client node, and the server node and the client node can be saved. Unauthorized use, destruction, eavesdropping, and the like of the file system due to the asynchronous assignment of the user identifier between the nodes can be prevented, and the security of the file system can be improved.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a distributed processing system according to an embodiment of the present invention.

FIG. 2 is a flowchart showing the operation of one embodiment of the present invention.

FIG. 3 is a diagram illustrating an example of a description of an export information file used in an embodiment of the present invention.

FIG. 4 is a diagram illustrating an example of asynchronous assignment of user identifiers between a server node and a client node.

[Explanation of symbols]

 1 communication medium, 2a, 2b, 2c node (computer system), 3a, 3b, 3c terminal device, 4a, 4b, 4c [local] file system, 5a, 5b, 5c export information file, 6a, 6b, 6c: Local access request judgment procedure section 7a, 7b, 7c: Remote access request judgment procedure section 8a, 8b, 8c: Remote mount information

Continued on the front page (56) References Akinori Saitan / Eiji Yamaguchi, UNIX Communication Notes 33 Use and Management of NFS Network Application (Part 7), UNIX MAGAZINE, Japan, ASCII, ASCII, 1991 3 On the 1st of the month, Vol. 6, No. 3 (Vol. 53), p. 35-47 (58) Field surveyed (Int. Cl. ⁷ , DB name) G06F 12/00 G06F 15/00

Claims (2)

(57) [Claims] 1. A remotely mounted server computer system in a distributed processing system in which a plurality of computer systems each having a file system are connected via a communication medium and these computer systems can be used mutually.
Remotely mounts the server computer system
Log in addition to the client computer system that is
Accept or deny access requests from users who are on
This is the specified information to deny, and at least the user making the access request logs on
On a client computer system
The user identifier assigned to the user and the server computer system
Client computer system name and server
For file systems of computer systems
Remotely mount the server computer system
From the client computer system
In combination with the type of Seth request means for specifying in advance only in the user identifier or a server computer system that is the remote mount
A from other client computer system to beam
If there is an access request, based on the specified information,
Server computer and means for determining the reject or accept
Distributed file characterized by being provided on the data system side
system. 2. A computer system comprising a plurality of computer systems, each having a file system, connected via a communication medium .
Others supported by each client computer system
Remotely mounts the file system of another computer system by remote mounting
In a network system in which a computer system can use the remotely mounted file system, a server computer system remotely mounted from another computer system sends an access request from the other computer system to the remotely mounted file system. To control, at least the other of the server computer system
From the computer system for each remote mounted file system, is provided by other computer systems to be accepted the access request to the file system, said other
User who logs on to another computer system
Combining an identifier and the other computer system name
Or an access information file containing only user identifiers as access control information and the file system
Log on to the other computer system for the system
When an access request from that user, the access
The other computer system on which the requesting user logs on
User identification given to the user by the system
And a means for determining acceptance or rejection of the access request based on the access control information of the access information file on the server computer system side .