System and method for providing secure access to network logical storage partitions

• US 20030056063A1
• Filed: 09/17/2001
• Published: 03/20/2003
• Est. Priority Date: 09/17/2001
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Hochmuth, Roland M., Martin, Robert Paul, Prouty, Bryan, Sene, Alassane, Yoshida, Stuart
• Granted Patent: US 7,500,069 B2
• Time in Patent Office: Days
• US Class Current: 711/152
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method for providing secure access to network secure logical storage partitions is disclosed. The method comprises automatically associating at least one of a plurality of secure logical storage partitions in a storage device in a network with at least one of a plurality of uniquely identified servers in a cell in the network in response to a request for storage over the network. The method also comprises automatically associating the cell with at least one client using network isolation of the cell, and using network isolation of the storage device to restrict access to at least one of the plurality of secure logical storage partitions to the one of the plurality of uniquely identified servers in the cell. In a particular embodiment, the method also comprises determining whether storage capacity is available for the at least one client in response to the request, and automatically creating the cell if the cell does not already exist.

Claims

1. A method for providing secure access to network logical storage partitions, comprising:

automatically associating at least one of a plurality of secure logical storage partitions in a storage device in a network with at least one of a plurality of uniquely identified servers in a cell in the network in response to a request for storage over the network;

automatically associating the cell with at least one client using network isolation of the cell; and

using network isolation of the storage device to restrict access to the at least one of the plurality of secure logical storage partitions to the one of the plurality of uniquely identified servers in the cell.

2. The method of claim 1, further comprising:

determining whether storage capacity is available for the at least one client in response to the request; and

automatically creating the cell if the cell does not already exist.

3. The method of claim 1, further comprising associating the at least one of the plurality of secure logical storage partitions with the at least one of the plurality of uniquely identified servers by:

identifying the at least one of the plurality of secure logical storage partitions in an access control list of a disk array controller operable to access the at least one of the plurality of secure logical storage partitions; and

associating the at least one of the plurality of secure logical storage partitions with the at least one of the plurality of uniquely identified servers in a switch operable to electronically connect to the disk array controller and to the at least one of the plurality of uniquely identified servers.

4. The method of claim 1, wherein the cell comprises an isolated virtual local area network.

5. The method of claim 1, further comprising using network isolation of the storage device to restrict access to the at least one of the plurality of secure logical storage partitions by employing at least one access control list at a layer 2 device in the network.

6. The method of claim 1, further comprising using network isolation of the storage device to restrict access to the at least one of the plurality of secure logical storage partitions by employing at least one access control list at a layer 3 device in the network.

7. The method of claim 1, further comprising using network isolation of the storage device to restrict access to the at least one of the plurality of secure logical storage partitions by employing at least one access control list at a layer 2 device that employs at least one of the Fibre Channel standards.

8. The method of claim 1, further comprising using network isolation of the cell by assigning at least one port to a virtual local area network.

9. A secure storage access configuration module, comprising:

a processing module residing in a network, the network comprising a plurality of secure logical storage partitions in a storage device and a plurality of uniquely identified servers;

a logic module residing on the processing module and operable to receive a request for storage over the network from at least one client;

automatically associate at least one of the plurality of secure logical storage partitions in the network with at least one of the plurality of uniquely identified servers in a cell in the network in response to the request;

automatically associate the cell with the at least one client using network isolation of the cell; and

use network isolation of the storage device to restrict access to the at least one of the plurality of secure logical storage partitions to the one of the plurality of uniquely identified servers in the cell.

10. The module of claim 9, wherein the logic module is operable to use network isolation to restrict access to the at least one of the plurality of secure logical storage partitions by employing at least one access control list at a layer 2 device in the network.

11. The module of claim 9, wherein the logic module is operable to use network isolation to restrict access to the at least one of the plurality of secure logical storage partitions by employing at least one access control list at a layer 3 device in the network.

12. The module of claim 9, wherein the logic module is operable to use network isolation of the storage device to restrict access to the at least one of the plurality of secure logical storage partitions by employing at least one access control list at a layer 2 device that employs at least one of the Fibre Channel standards.

13. The module of claim 9, wherein the logic module is operable to use network isolation of the cell by assigning at least one port to a virtual local area network.

14. The module of claim 9, wherein the logic module is further operable to:

associate a second at least one of the plurality of secure logical storage partitions in the network with the at least one of the plurality of uniquely identified servers in the cell, and

wherein access to the second at least one of the plurality of secure logical storage partitions is restricted to the at least one of the plurality of uniquely identified servers in the second cell.

15. The module of claim 9, wherein the logic module is accessed by the at least one client in a distributed network environment.

16. The module of claim 9, wherein the logic module is further operable to:

associate a second at least one of the plurality of secure logical storage partitions in the network with a second at least one of the plurality of uniquely identified servers in a second cell in the network, associate the second at least one of the plurality of uniquely identified servers with at least one second client, and

wherein access to the second at least one of the plurality of secure logical storage partitions is restricted to the second at least one of the plurality of uniquely identified servers in the second cell.

17. The module of claim 9, wherein the cell comprises an isolated virtual local area network.

18. The module of claim 9, wherein the logic is further operable to

receive a request for storage over the network;

determine whether storage capacity is available for the client; and

create the cell if the cell does not already exist.

19. A secure network storage access system, comprising:

a secure file server module having a plurality of uniquely identified servers;

a disk array module coupled to the secure file server module, the disk array module having a plurality of secure logical storage partitions; and

an administrative module coupled to the secure file server module, the administrative module operable to

automatically associate at least one of a plurality of secure logical storage partitions in the disk array module in the network with at least one of a plurality of uniquely identified servers in a cell in the network,

automatically associate the cell with at least one client using network isolation of the cell, and

use network isolation of the disk array module to restrict access to the at least one of the plurality of secure logical storage partitions to the one of the plurality of uniquely identified servers in the cell.

20. The system of claim 19, wherein the disk array module comprises a disk array controller coupled to the at least one of the plurality of secure logical storage partitions associated with the at least one of the plurality of uniquely identified servers.

21. The system of claim 19, wherein the cell comprises at least one isolated virtual local area network.

22. The system of claim 19, wherein the administrative module is further operable to receive a request for storage access from the at least one client.

23. The system of claim 19, wherein the administrative module is operable to use network isolation of the disk array module to restrict access to the at least one of the plurality of secure logical storage partitions by employing at least one access control list at a layer 2 device in the network.

24. The system of claim 19, wherein the administrative module is operable to use network isolation of the disk array module to restrict access to the at least one of the plurality of secure logical storage partitions by employing at least one access control list at a layer 3 device in the network.

25. The system of claim 19, wherein the administrative module is operable to use network isolation in the disk array module to restrict access to the at least one of the plurality of secure logical storage partitions by employing at least one access control list at a layer 2 device that employs at least one of the Fibre Channel standards.

26. The system of claim 19, wherein the administrative module is operable to use network isolation of the cell by assigning at least one port to a virtual local area network.