Secure access to shared storage resources

Abstract

A system for accessing stored information may comprise a first storage device for storing the information, a second storage device for storing an instance of the information, a first network providing communication between the first and second storage devices, and a second network providing access to the instance of the information but no access to the first network and the first storage device.

1 - 19 . (canceled) 
     
     
         20 . A system for accessing stored information, comprising:
 at least a first processor;   a memory; and   a program including a plurality of instructions stored in the memory that, in response to selection of an attribute, are executed by the at least first processor to:   store first storage information in a storage device of a storage system on a first network,   transform the first storage information into a first virtual storage instance,   provide access to the first virtual storage instance on a second network not in communication with the first network and the storage device,   enable over the second network the modification of the first virtual storage instance to create a modified first virtual storage instance,   transform the first modified virtual storage instance into first modified storage information based on the first modified virtual storage instance, and   store on the storage device the first modified storage information.   
     
     
         21 . The system of  claim 20 , wherein the plurality of instructions includes instructions that, in response to selection of the attribute, are also executed by at least the first processor to:
 store second storage information in the storage device different from the first storage information on the first network,   transform the second storage information into a second virtual storage instance,   provide access to the second virtual storage instance on the second network,   enable over the second network the modification of the second virtual storage instance to create a modified second virtual storage instance,   transform the second modified virtual storage instance into modified second storage information, and   store on the first network the modified second storage information in the storage device.   
     
     
         22 . The system of  claim 21 , wherein the plurality of instructions includes instructions that, in response to selection of the attribute, are also executed by at least the first processor to:
 exchange information between the first and second networks through a hypervisor of the storage system, and   maintain by the hypervisor access isolation between the first and second networks.   
     
     
         23 . A computer program product for accessing stored information, the computer program product comprising:
 a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code being executable by a processor to:   store first storage information in a storage device of a storage system on a first network,   transform the first storage information into a first virtual storage instance,   provide access to the first virtual storage instance on a second network not in communication with the first network and the storage device,   enable over the second network the modification of the first virtual storage instance to create a first modified virtual storage instance,   transform the first modified virtual storage instance into first modified storage information based on the first modified virtual storage instance, and   store on the storage device the first modified storage information.   
     
     
         24 . The computer program product of  claim 23 , wherein the computer readable code is also configured to create on the second network a virtual storage space instance that resembles a pre-selected file system and includes the first virtual storage instance, the virtual storage space being created in a kernel-based virtual machine environment. 
     
     
         25 . The method computer program product of  claim 24 , wherein the computer readable code is also configured to enable modification of the virtual storage space instance by a first virtual machine instance, the first virtual machine instance not being in communication with the first network and the storage device. 
     
     
         26 . A system for accessing stored information, comprising:
 a first storage device for storing the information,   a second storage device for storing an instance of the information,   a first network providing communication between the first and second storage devices, and   a second network providing access to the instance of the information but no access to the first network and the first storage device.