Security method and system for storage subsystem

• US 20060161548A1
• Filed: 01/12/2006
• Published: 07/20/2006
• Est. Priority Date: 01/14/2000
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Okami, Yoshinori, Ito, Ryusuke
• Granted Patent: US 7,606,806 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2003/0697 device management, e.g. handlers, drivers, I/O schedulers
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0635 by changing the path, e.g. traffic rerouting, path reconfiguration
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: Y10S 707/954 Relational
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

According to the present invention, techniques for performing security functions in computer storage subsystems in order to prevent illegal access by the host computers according to logical unit (LU) identity are provided. In representative embodiments management tables can be used to disclose the Logical Unit in the storage subsystem to the host computers in accordance with the users operational needs. In a specific embodiment, accessibility to a storage subsystem resource can be decided when an Inquiry Command is received, providing systems and apparatus wherein there is no further need to repeatedly determine accessibility for subsequent accesses to the Logical Unit. Many such embodiments can maintain relatively high performance, while providing robust security for each LU.

Claims

1. A storage system adapted to be coupled to a plurality of host computers, said storage system comprising:

a plurality of disk drives storing data from said host computers, said disk drives forming a plurality of logical units, said logical units each having a logical unit number; and

a controller having an access management map,

wherein said access management map includes an identifier of a host group having some of said host computers and said logical units, one or more of said logical unit numbers being mapped to said identifier of said host group, said access management map being used to control access from said host group to said logical units.

2. The storage system according to claim 1, wherein said access management map permits mapping of different logical unit numbers for different host groups.

3. The storage system according to claim 1, wherein said access management map does not permit mapping of different logical unit numbers to one host group.

4. The storage system according to claim 1, wherein said access management table having a relationship of a first host group and a first logical unit number.

5. The storage system according to claim 1, wherein the controller permits access, if a first host computer of said first host group accesses to said first logical unit number.

6. The storage system according to claim 1, wherein the controller deny access if a second host computer being a host computer of said first host group accesses to said first logical unit number.

7. The storage system according to claim 1, wherein some of said logical unit numbers allocated to each host group begins with 0.

8. The storage system according to claim 1, wherein some of said logical unit numbers allocated to each host group begins with 0 and increments by 1.

9. The storage system according to claim 1, wherein each of said logical unit numbers can be specified by a user.