Method and system for governing access to storage device on SAN

• US 20070079091A1
• Filed: 09/30/2005
• Published: 04/05/2007
• Est. Priority Date: 09/30/2005
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Gold, Stephen, Collins, Kevin, Wildt, Jason
• Granted Patent: US 7,917,712 B2
• Time in Patent Office: Days
• US Class Current: 711/163
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 21/805 using a security table for the storage sub-system
• CPC Class Codes: G06F 3/0614 Improving the reliability of storage systems
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0632 by initialisation or re-initialisation of storage systems
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

The present invention in at least some embodiments relates to improved methods and systems for governing access to SAN data storage devices (or simply “SAN devices”) employed in SAN systems. In some embodiments, the method involves storing a list at a SAN device. The list can be an exclusion list identifying devices that are not allowed to access the SAN device. During normal operation, the SAN device automatically contacts the SAN (or a component of the SAN, such as a SAN switch) to determine the identities of new devices that have entered into communication with the SAN. The SAN device then automatically updates the exclusion list to include those new devices such that, without further instructions, the SAN device is not accessible by those new devices. The method further can relate to the setup and failure recovery of SAN devices employed in SAN systems.

Claims

1. A method of governing access to a storage device connected to a storage area network (SAN), the method comprising:

obtaining a first list, wherein access to the storage device by other devices is governed at least in part based upon the first list, and wherein each of the other devices is at least one of fully precluded from accessing the storage device, partly precluded from accessing the storage device, and allowed to access the storage device;

querying the SAN to determine if at least one additional other device has entered into communication with the SAN; and

automatically updating the first list to reflect the at least one additional other device so that access to the storage device by the at least one additional other device is also governed at least in part based upon the first list.

2. The method of claim 1, further comprising:

querying the SAN to obtain a second list of the other devices that are in communication with the SAN, prior to the querying of the SAN to determine if the at least one additional other device has entered into communication with the SAN.

3. The method of claim 2, further comprising:

storing the second list, wherein the second list is stored in at least one of a first memory device associated with the storage device and a backup memory device.

4. The method of claim 2, wherein the second list is updated to reflect information received based upon the querying of the SAN to determine if the at least one additional other device has entered into communication with the SAN.

5. The method of claim 4, wherein the querying of the SAN is repeated on at least one of a substantially periodic basis and a substantially continuous basis, such that the second list is updated on at least one of a substantially periodic basis and a substantially continuous basis.

6. The method of claim 1, wherein the first list is an exclusion list, and the storage device is configured to fully preclude at least one of the other devices that are identified on the exclusion list from accessing the storage device.

7. The method of claim 6, wherein the automatic updating of the first list results in the exclusion list being updated to reflect the at least one additional other device and wherein, subsequent to the updating of the first list, the storage device fully precludes the at least one additional other device from accessing the storage device.

8. The method of claim 1, wherein the first list is a granted list, and the storage device is configured to allow the other devices identified on the granted list to access the storage device.

9. The method of claim 1, wherein the querying of the SAN involves contacting a SAN switch that has available information regarding the other devices that are in communication with the SAN.

10. The method of claim 1, wherein the first list is at least one of obtained from, and modified based upon, at least one input signal received from a user interface.

11. The method of claim 1, further comprising:

storing the first list on a backup memory device; and

after an occurrence of an event, recovering the first list from the backup memory device.

12. The method of claim 11, wherein the storage device precludes the other devices listed on the recovered first list from accessing the storage device.

13. The method of claim 11, further comprising:

storing a second list on the backup memory device;

after the occurrence of the event, recovering the second list from the backup memory device;

querying the SAN to obtain information regarding the other devices that are currently in communication with the SAN;

comparing the recovered second list with the obtained information; and

updating the second list to include any of the other devices that are currently in communication with the SAN that are not on the recovered second list.

14. The method of claim 11, wherein the event is a failure causing a loss of at least a portion of information that was stored on the storage device prior to the event.

15. The method of claim 1,

wherein the storage device includes at least one of a hard disk drive, a tape data storage device, a CD-ROM device, an electronic memory device, and another memory device, and

wherein the other devices include at least one of a computer, a workstation, a controller, and a data storage device.

16. The method of claim 1, wherein at least one of the first list, at least one attribute, and other information is at least one of obtained from and stored in an additional repository.

17. A method of governing access to a storage device connected to a storage area network (SAN) that is in communication with a plurality of other devices, the method comprising:

storing, on a first backup memory device, a first list regarding at least one of the other devices that is in communication with the SAN;

recovering the first list after a failure has occurred; and

based upon the recovered first list, determining whether the at least one other device is at least one of precluded from accessing the storage device, partly allowed to access the storage device, and fully allowed to access the storage device.

18. The method of claim 17, wherein the first list is at least one of an exclusion list and a granted list.

19. The method of claim 17, further comprising:

storing, on at least one of the first backup memory device and a second backup memory device, a second list of each of the other devices that are in communication with the SAN;

recovering the second list after the failure has occurred;

comparing the recovered second list with further information obtained from the SAN after the failure has occurred; and

determining based upon the comparison whether the other devices in communication with the SAN have changed between a first time prior to the failure and a second time after the failure.

20. The method of claim 19, further comprising:

updating the first list to include at least one newly-added device, if it is determined based upon the comparison that the other devices in communication with the SAN have changed between the first and second times so as to include the at least one newly-added device.

21. A data storage device for implementation in connection with a storage area network (SAN) that is also in communication with a plurality of other devices, the data storage device comprising:

first means for storing data that is capable of being provided onto the SAN;

second means for storing a first list of at least one of the other devices that is in communication with the SAN; and

a control device in communication with each of the first means and the second means, wherein the control device determines whether at least a portion of the data stored by the first means can be accessed by the at least one other device based at least in part upon the first list.

22. The data storage device of claim 21, wherein the second means also stores a second list of the plurality of other devices, wherein the data storage device is configured to automatically and repeatedly query the SAN to identify changes in the plurality of other devices and, when the changes are identified, to update each of the first and second lists.

23. The data storage device of claim 21, wherein at least one of the following is true:

the first means and second means are respective subportions of a single memory device; and

the first means and second means are two distinct memory devices.

24. A SAN system comprising the data storage device, the SAN, and the plurality of other devices of claim 21, the SAN system further comprising:

a user interface coupled to at least one of the data storage device and the SAN, wherein at least one of the first list and a second list are determined based at least in part upon signals provided from the user interface.

25. The SAN system of claim 24, further comprising:

a backup memory device coupled at least indirectly to the data storage device, wherein at least one of the first list and the second list are stored on the backup memory device.

26. A data storage device for implementation in connection with a storage area network (SAN) that is also in communication with a plurality of other devices, the data storage device comprising:

a primary memory component, wherein data that is capable of being provided onto the SAN is stored in the primary memory component;

a second memory component, wherein information regarding at least one of the other devices that is in communication with the SAN is stored in the second memory component; and

a controller that is in communication with each of the first and second memory components,

wherein a decision made by the controller regarding whether the primary memory component can be accessed depends at least in part upon the information stored in the second memory component.

27. The data storage device of claim 26, wherein the information includes at least one of an exclusion list, a granted list, a partial granted list, a set of characteristics, a set of attributes, a set of policies, and an array.

28. The data storage device of claim 26, wherein each of the first and second components is a cache, a hard disk drive, a tape data storage device, a CD-ROM device, an electronic memory device, and another memory device.

29. The data storage device of claim 26, wherein the information is obtained from at least one of a user interface, one of the other devices on the SAN, a SAN switch, and a repository.

30. The data storage device of claim 29, wherein the first and second memory components are portions of a single memory device, and wherein the data storage device further includes a communication link by which the data storage device can communicate with the user interface.

31. The data storage device of claim 26, further comprising a backup memory device that stores both first and second lists.

32. A computer-readable medium embodying instructions for a processor to perform a method of managing a data storage device to operate in connection with a storage area network (SAN) that is also in communication with a plurality of other devices, the method comprising:

obtaining a first set of information, wherein access to the storage device by the other devices is governed at least in part based upon the first set;

causing the data storage device to query the SAN to determine if at least one additional other device has entered into communication with the SAN; and

updating the first set to reflect the at least one additional other device so that access to the storage device by the at least one additional other device is also governed at least in part based upon the first set.

33. The computer-readable medium of claim 32, wherein the method to be performed by the processor further includes at least one of:

communicating with an external device to obtain at least one of the first set and a second set; and

receiving a backup copy of the first set from a backup memory device subsequent to an occurrence of a failure.

34. The computer readable medium of claim 32, wherein the method to be performed by the processor further includes:

determining based upon the first set that at least some data from the data storage device can be provided onto the SAN in response to an access request received off of the SAN from at least one of the other devices; and

causing a communication of the at least some data onto the SAN.

35. A SAN data storage device comprising the computer readable medium and processor of claim 32, and further comprising at least one of:

a communication link for use in communicating information with a user interface;

a backup memory device; and

a non-SAN communication link for communicating with a repository that is not in communication with the SAN.