Container Storage Access via Device Emulator for QoS and Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional solutions for cloud computing environments face challenges in enforcing Quality of Service (QoS) and data security for containers accessing storage, as they lack secure data isolation and efficient performance monitoring, leading to overburdened cluster management systems and inadequate I/O path management.
Innovation Solution
Implementing a computing infrastructure that uses a device emulator as a common interface for both containers and virtual machines to access storage, creating a unified data I/O path and adding a container I/O component to the host operating system to process hypervisor-encoded files, thereby enabling secure and efficient data access and monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If containers directly access storage devices via mount points, then data access efficiency is improved, but data security and isolation are compromised
Solution Approach 1:
The patent introduces a device emulator as an intermediary component between containers and storage devices. The device emulator receives I/O requests from containers, translates them into appropriate storage device calls, and manages access control. This mediator enables containers to access storage efficiently while maintaining security boundaries, as the emulator can enforce access policies and isolate container workloads from direct file system exposure.
2Adaptability or versatility
If separate I/O paths are used for containers and virtual machines, then access flexibility is improved, but system complexity and management overhead increase
Solution Approach 1:
The patent implements a universal device emulator that serves both containers and virtual machines through a common interface. The device emulator is designed to handle I/O requests from multiple types of virtualized workloads, translating diverse access patterns into unified storage device calls. This multi-functional approach maintains access flexibility for different workload types while reducing the number of separate I/O paths and simplifying management overhead.
3Ease of operation
If containers mount the entire file system, then data access capability is improved, but data isolation and security are worsened
Solution Approach 1:
The patent applies local quality by enabling containers to access specific portions or views of the storage device through the device emulator, rather than mounting the entire file system. The device emulator can present customized data views to different containers based on their access requirements, providing each container with only the necessary data subset. This approach maintains ease of data access for authorized operations while preventing containers from accessing data they should not see, thereby preserving data isolation and security.
Data Source
AI summary
Systems and methods for Quality of Service (QoS) enforcement and data security for containers accessing storage. An example method may comprise: receiving an input/output (I/O) call initiated by a container running on a host computer system to request data from a storage device; translating the I/O call into a device emulator call to a device emulator emulating a storage device; sending the device emulator call to the device emulator; and receiving, from the device emulator, a response comprising the data retrieved from the storage device.