Computer system for allocating storage area to computer based on security level

• US 20050192923A1
• Filed: 04/21/2004
• Published: 09/01/2005
• Est. Priority Date: 02/27/2004
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Hitachi, Ltd.
• Inventors: Nakatsuka, Daiki
• Granted Patent: US 7,099,904 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/288 Distributed intermediate devices, i.e. intermediate devices for interaction with other intermediate devices on the same level
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: Y10S 707/959 Network
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99956 File allocation

Abstract

A management server takes charge of managing information about whether a physical port is provided with means for security protection. Based on such information, the management server automatically determines to which physical port a volume is to be assigned. As such, an assignment process is executed.

Claims

1. A computer system, comprising:

a computer;

a storage system connected to the computer over a network; and

a second computer connected to the computer and the storage system, wherein

the second computer includes information about the storage system, selects, in response to a request from the computer, the storage system meeting the request based on the information, and transmits a command to the selected storage system for creating a storage area for use by the computer based on the request of the computer, wherein

the storage system creates the storage area meeting the request of the computer in accordance with the command, and forwards a creation completion notice to the second computer, wherein

after receiving the notice, the second computer notifies the computer of path information for the storage area created by the storage system.

2. A computer system according to claim 1, wherein

information about the storage system is information about a security level of the storage system, wherein

the request of the computer is a request for creating the storage area possible to secure the security level to be high.

3. A computer system according to claim 2, wherein

the information about the security level is information about whether or not a device in the storage system used for connectionwith the network can execute an IPSecprocess, wherein

the high security level means that the device is capable of the IPSec process.

4. A computer system according to claim 3, wherein

the command is a command for interrelating the storage area to the device capable of the IPSec process located in the storage system, wherein

in accordance with the command, the storage system interrelates the created storage area to the device capable of the IPSec process, wherein

the second computer notifies the computer of address information as the path information in the network assigned to the device capable of the IPSec process.

5. A computer system according to claim 3, wherein

the command is a command for interrelating the storage area to the device capable of the Ipsec process plurally found located in the storage system, wherein

in accordance with the command, the storage system interrelates the created storage area to the devices capable of the IPSec process, wherein

the second computer notifies the computer of address information as the path information in the network assigned to each of the devices capable of the IPSec process.

6. A computer system according to claim 5, wherein

the second computer further includes information about the computer (hereinafter, “

second information”

) connected to the network that can use the storage area in the storage system, wherein

the computer issues arequest for forwarding, to the second computer, information about the storage area available theref or, wherein

based on the second information, the second computer transmits, to the computer having issued the forwarding request, the path information to the storage area in the storage area that is available for the computer.

7. A computer system according to claim 6, wherein

after receiving the notice, the second computer registers, with the second information, information about the computer having requested creation of the storage area when notifying the computer of the path information about the storage area created in the storage system.

8. A computer system according to claim 1, wherein

the information about the storage system is information about the security level of the storage system, wherein

the request of the computer is a request for creating the storage area, wherein

the second computer commands the storage system to create the storage area depending on the security level of the computer.

9. A computer system according to claim 8, wherein

the information about the security level is information about whether or not a device in the storage system or the computer used for connection with the network can execute an IPSec process, wherein

when the security level of the computer is in a level having the device capable of the IPSec process, the command is a command for interrelating the storage area to the device capable of the IPSec process out of others located in the storage system.

10. A computer system according to claim 1, wherein

the information about the storage system is information about whether or not a device in the storage system used for connection with the network can execute an IPSec process, wherein

the request of the computer is a request for creating the storage area, wherein

based on the request for creating the storage area, the second computer transmits a command to the storage system for creating the storage area interrelating the device capable of the IPSec process located in the storage system, wherein

in accordance with the command, the storage system interrelates the created storage area to the device capable of the IPSec process, wherein

the second computer notifies the computer of address information as the path information in the network assigned to the device capable of the IPSec process.

11. A computer system according to claim 1, wherein

the information about the storage system is information about whether or not a device in the storage system used for connection with the network can execute an IPSec process, wherein

the request of the computer is a request for creating the storage area, wherein

based on the request for creating the storage area, the second computer transmits a command to the storage system for creating the storage area, wherein

in accordance with the command, the storage system interrelates the created storage area to the device capable of the IPSec process plurally found, wherein

the second computer notifies the computer of address information as the path information in the network assigned to each of the devices capable of the IPSec process.

12. A computer according to claim 1, wherein

the information about the storage system is information about whether or not a device in the storage system used for connectionwith the network can execute an IPSec process, wherein

the request of the computer is a request for creating the storage area, wherein

based on the request for creating the storage area, the second computer transmits a command to the storage system for creating the storage area, wherein

in accordance with the command, the storage system interrelates the created storage area to the device capable of the IPSec process and to the device incapable of the IPSec process, wherein

the second computer notifies the computer of address information as the path information in the network assigned to the device capable of the IPSec process and address information in the network assigned to the device incapable of the IPSec process.

13. A computer system according to claim 12, wherein

the computer selects a piece of the address information plurally received from the second computer to make access to the storage area of the storage system.

14. A computer system according to claim 13, wherein

when the computer is in need of the high security level for a process, the computer selects the address information corresponding to the device capable of the IPSec process to make access to the storage area in the storage system.

17. A computer system according to claim 14, wherein the computer and the storage system are each provided plurally.

15. A management computer connected to a computer and a storage system, comprising:

a control section;

memory; and

an interface to be connected to a network having a connection with the computer and the storage system, wherein

the memory includes information indicating whether or not a device in the storage system to be connected to the network is capable of an IPSec process, wherein

when the computer makes a request to create a storage area in the storage system over the interface, the control section transmits, to the storage system, a command for creating the storage area to interrelates to the device capable of the IPSec process based on the request, wherein

after receiving a completion notice from the storage system, the computer is notified of address information assigned to a device capable of the IPSec process.

16. A computer connected to a management computer and a storage system, comprising:

a control section;

memory; and

an interface to be connected to a network having a connection with the management computer and the storage system, wherein

the management computer is requested over the interface to create a storage area in the storage system, and the control section stores in the memory information about a plurality of addresses forwarded from the management computer, wherein

a piece is selected from the information about the address to make access to the storage area in the storage system.

18. A computer system, comprising:

a computer;

a storage system to be connected with the computer over a network; and

a second computer to be connected to the computer and the storage system, wherein the second computer includes information about whether a device in the storage system used for connection with the network is capable of an IPSec process, selects, in response to a request for creating a storage area interrelated to the device capable of the IPSec process of the computer, the storage system meeting the request based on the information, and transmits a command to the selected storage system for interrelating the storage-areausedby the computer to the device capable of the IPSec process located in the storage system, wherein the storage system interrelates the created storage area to the device capable of the IPSec process in accordance with the command, and forwards to the second computer of a creation completion notice, wherein the second computer notifies the computer of address information in the network assigned to the device capable of the IPSec process, wherein based on the address information, the computer makes access to the storage area in the storage system via the device capable of the IPSec process.