Determining virtual adapter access controls in a computing environment

• US 10,027,674 B2
• Filed: 12/14/2017
• Issued: 07/17/2018
• Est. Priority Date: 03/14/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Friedrich, Ralph, Higgs, Raymond M., Kuch, George P., Moore, Elizabeth A., Pandich, Johnathon R., Sczepczenski, Richard M.
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): KHAN, HASSAN ABDUR-RAHMAN
• Application Number:
  US15/841,865
• Publication Number:
  US 20180109534A1
• Time in Patent Office: 215 Days
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45545 Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 49/3054 Auto-negotiation, e.g. access control between switch gigabit interface connector [GBIC] and link
• CPC Class Codes: H04L 49/354 for supporting virtual local area networks [VLAN]
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A control component of a computing environment initiates sending of request(s) over a network of the computing environment by an activated virtual adapter. The activated virtual adapter is hosted on a physical adapter of a host system coupled to the network, and is for use by a guest, hosted by the host system, in performing data input and output. The request(s) retrieve access control information from the network indicative of access control(s) enforced in controlling access by the activated virtual adapter to network component(s). The initiating provides indication(s) to the physical adapter, absent involvement of the guest, that the request(s) be sent by the virtual adapter. Based on the initiating, the control component obtains the access control information from the physical adapter, and determines, based on that information, the access control(s) being enforced by the network in controlling access by the activated virtual adapter to the network component(s).

Claims

1. A computer program product, comprising:

a non-transitory computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising;

sending one or more requests over a network by an activated virtual adapter, the activated virtual adapter being hosted on a physical adapter of a host system coupled to the network, the virtual adapter being for use by a guest, hosted by the host system, in performing data input and output, and the sending being based on one or more indications provided to the physical adapter, absent involvement of the guest, that the one or more requests be sent by the virtual adapter;

receiving access control information by the activated virtual adapter from one or more responses to at least one request of the one or more requests, the access control information being indicative of one or more access controls enforced by the network in controlling access by the activated virtual adapter to one or more network components of the network;

providing at least some of the access control information to a control component, wherein the sending the one or more requests, the receiving the access control information, and the providing the at least some of the access control information are performed absent involvement of the guest; and

returning the activated virtual adapter to an initial state of the virtual adapter that the virtual adapter was in prior to activation of the virtual adapter.

2. The computer program product of claim 1, wherein the method further comprises, based on a determination from the at least some of the access control information that that an access control of the one or more access controls is not appropriate for controlling access by the activated virtual adapter to a network component of the one or more network components, reconfiguring the activated virtual adapter or a network component of the network prior to activating the guest.

3. The computer program product of claim 1, wherein the initial state of the virtual adapter comprises a deactivated or non-configured state, and returning the activated virtual adapter to the initial state comprises returning the virtual adapter to the deactivated or non-configured state.

4. The computer program product of claim 1, wherein the guest uses the activated virtual adapter contemporaneous to the sending and the receiving by the activated virtual adapter, wherein the sending and the receiving by the activated virtual adapter are non-disruptive of the use of the activated virtual adapter by the guest in performing data input and output.

5. The computer program product of claim 1, wherein the one or more network components comprise a storage area network, and wherein the received access control information comprises logical unit number masking data or zoning configuration data for controlling zones of the storage area network.

6. The computer program product of claim 1, wherein a first request of the one or more requests is to log the activated virtual adapter into the network, and a second request of the one or more requests is used to determine remote ports of the network that are accessible to the activated virtual adapter, wherein the received access control information comprises an indication of one or more remote ports of the network that are accessible to the activated virtual adapter.

7. The computer program product of claim 6, wherein a third request of the one or more requests is to log into a remote port, of the one or more remote ports, accessible to the activated virtual adapter.

8. The computer program product of claim 7, wherein the remote port is of a storage device hosting a storage array, wherein a logical unit of the storage array is indicated by a logical unit number, and wherein a fourth request of the one or more requests comprises a logical unit number interrogation request.

9. The computer program product of claim 1, wherein the sending, the receiving, the providing, and the returning are performed while the guest remains stopped from execution.

10. The computer program product of claim 1, wherein the sending, the receiving, the providing, and the returning are performed with the guest not being loaded into central electronic complex memory.

11. The computer program product of claim 1, wherein the sending, the receiving, the providing, and the returning are performed absent communication between the control component and the guest.

12. The computer program product of claim 1, wherein the physical adapter is a hardware host bus adapter of an input-output subsystem of the host, and the physical host bus adapter hosts the virtual adapter.

13. A computer system comprising:

a memory; and

a processing circuit in communication with the memory, wherein the computer system is configured to perform a method, the method comprising;

sending one or more requests over a network by an activated virtual adapter, the activated virtual adapter being hosted on a physical adapter of a host system coupled to the network, the virtual adapter being for use by a guest, hosted by the host system, in performing data input and output, and the sending being based on one or more indications provided to the physical adapter, absent involvement of the guest, that the one or more requests be sent by the virtual adapter;

receiving access control information by the activated virtual adapter from one or more responses to at least one request of the one or more requests, the access control information being indicative of one or more access controls enforced by the network in controlling access by the activated virtual adapter to one or more network components of the network;

providing at least some of the access control information to a control component, wherein the sending the one or more requests, the receiving the access control information, and the providing the at least some of the access control information are performed absent involvement of the guest; and

returning the activated virtual adapter to an initial state of the virtual adapter that the virtual adapter was in prior to activation of the virtual adapter.

14. The computer system of claim 13, wherein the method further comprises, based on a determination from the at least some of the access control information that that an access control of the one or more access controls is not appropriate for controlling access by the activated virtual adapter to a network component of the one or more network components, reconfiguring the activated virtual adapter or a network component of the network prior to activating the guest.

15. The computer system of claim 13, wherein the initial state of the virtual adapter comprises a deactivated or non-configured state, and returning the activated virtual adapter to the initial state comprises returning the virtual adapter to the deactivated or non-configured state.

16. The computer system of claim 13, wherein the guest uses the activated virtual adapter contemporaneous to the sending and the receiving by the activated virtual adapter, wherein the sending and the receiving by the activated virtual adapter are non-disruptive of the use of the activated virtual adapter by the guest in performing data input and output.

17. The computer system of claim 13, wherein the one or more network components comprise a storage area network, and wherein the received access control information comprises logical unit number masking data or zoning configuration data for controlling zones of the storage area network.

18. The computer system of claim 13, wherein a first request of the one or more requests is to log the activated virtual adapter into the network, and a second request of the one or more requests is used to determine remote ports of the network that are accessible to the activated virtual adapter, wherein the received access control information comprises an indication of one or more remote ports of the network that are accessible to the activated virtual adapter.

19. The computer system of claim 18, wherein a third request of the one or more requests is to log into a remote port, of the one or more remote ports, accessible to the activated virtual adapter.

20. The computer system of claim 19, wherein the remote port is of a storage device hosting a storage array, wherein a logical unit of the storage array is indicated by a logical unit number, and wherein a fourth request of the one or more requests comprises a logical unit number interrogation request.