VOLUME MANAGEMENT METHOD IN A STORAGE APPARATUS HAVING ENCRYPTION FEATURE

• US 20090164780A1
• Filed: 03/06/2008
• Published: 06/25/2009
• Est. Priority Date: 12/19/2007
• Status: Abandoned Application

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Osaki, Nobuyuki, Murayama, Koichi
• Application Number:
  US12/043,612
• Publication Number:
  US 20090164780A1
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/805 using a security table for the storage sub-system
• CPC Class Codes: G06F 3/0604 Improving or facilitating administration, e.g. storage management
• CPC Class Codes: G06F 3/062 Securing storage systems
• CPC Class Codes: G06F 3/0631 by allocating resources to storage systems
• CPC Class Codes: G06F 3/065 Replication mechanisms
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 3/0683 Plurality of storage devices

Abstract

The invention provides a computer system including a storage apparatus having an encryption feature, a management computer for running a management program for managing the storage apparatus, and an application host computer, wherein when allocating a logical volume or creating a copy pair, the management program selects, from the storage apparatus, a logical volume that satisfies a security level required by an application program that uses the logical volume to allocate the logical volume or create a copy pair.

Claims

1. A management computer connected to plural host computers and plural storage apparatuses, each host computer being designed to execute an application program, and each storage apparatus connected to the host computers having plural logical volumes,

the management computer comprising:

memory for storing first association information for associating each application program with application security level information indicating a security level required by the application program, and second association information for associating each logical volume with logical volume security level information indicating a security level in the logical volume;

an interface for receiving a logical volume allocation request specifying an application program; and

a processor for specifying, based on the first association information, application security level information that indicates the security level required by the application program specified by the logical volume allocation request, and selecting, based on the second association information, from the plural logical volumes, a logical volume that satisfies the security level indicated by the specified application security level information.

2. The management computer according to claim 1, wherein the application security level information is information that indicates an encryption level required by an application program, and the logical volume security level information is information that indicates an encryption level in an logical volume.

3. The management computer according to claim 1, wherein the application security level information and the logical volume security information are determined based on information about an encryption level and theft risk in each storage apparatus.

4. The management computer according to claim 1, wherein the management computer is connected to a management client computer, and the interface receives the logical volume allocation request by receiving that request from the management client computer.

5. The management computer according to claim 1, wherein the interface receives a logical volume allocation request that specifies both an application program and a storage apparatus,

wherein the processor specifies, based on the first association information, application security level information that indicates the security level required by the application program specified by the logical volume allocation request, and selects, based on the second association information, a logical volume that satisfies the security level indicated by the specified application security level information from logical volumes included in the storage apparatus specified by the logical volume allocation request.

6. The management computer according to claim 1, wherein the processor selects plural logical volumes that satisfy the security level indicated by the specified application security level information, and sends via the interface, information indicating the selected logical volumes;

the interface receives a logical volume specification request for specifying a logical volume in the selected logical volumes; and

the processor allocates the logical volume specified by the logical volume specification request to a host computer that executes the application program specified by the logical volume allocation request.

7. The management computer according to claim 1, wherein if the processor selects plural logical volumes, the processor specifies an arbitrary logical volume, and allocates the specified logical volume to a host computer that executes the application program specified by the logical volume allocation request.

8. The management computer according to claim 1, wherein the first association information associates each application program with application security level information that indicates the security level required by the application program and performance level information that indicates the performance level required by the application program;

the second association information associates each logical volume with logical volume security level information that indicates the security level in the logical volume and performance level information that indicates the performance level in the logical volume; and

the processor specifies, based on the first association information, the application security level information and the performance level information about the application program specified by the logical volume allocation request, and selects, based on the second association information, from the plural logical volumes, a logical volume that satisfies the security level indicated by the specified application security level information and the performance level indicated by the specified performance level information.

9. A management computer connected to plural host computers and plural storage apparatuses, each host computer being designed to execute an application program, and each storage apparatus connected to the host computers having plural logical volumes,

the management computer comprising:

memory for storing a first table for associating each application program with application security level information that indicates a security level required by the application program, and a second table for associating each logical volume with logical volume security level information that indicates a security level in the logical volume and an application program that uses the logical volume;

an interface for receiving a copy pair creation request specifying a copy source logical volume; and

a processor for specifying, based on the second table, an application program that uses the copy source logical volume, specifying, based on the first table, security level information required by the specified application program, and selecting, based on the second table, from the plural logical volumes, a logical volume that satisfies the security level indicated by the specified security level information.

10. The management computer according to claim 9, wherein the application security level information is information that indicates an encryption level required by an application program, and the logical volume security level information is information that indicates an encryption level in a logical volume.

11. The management computer according to claim 9, wherein the application security level information and the logical volume security information are determined based on information about an encryption level and theft risk in each storage apparatus.

12. The management computer according to claim 9, wherein the interface is designed to receive a copy pair creation request that specifies both a copy source logical volume and a copy destination-side storage apparatus;

and

the processor specifies, based on the second table, an application program that uses the copy source logical volume, specifies, based on the first table, application security level information that indicates the security level required by the specified application program, and selects, from logical volumes included in the copy destination-side storage apparatus, a logical volume that satisfies the security level indicated by the security level information.

13. The management computer according to claim 12, wherein the memory also stores encryption feature information that indicates whether in each storage apparatus a feature of encrypting data to be transmitted is available and a level of encryption, and

wherein if no logical volume in those included in the copy destination-side storage apparatus satisfies the security level indicated by the specified security level information, the processor selects, based on the encryption feature information and the second table, from the logical volumes included in the copy destination-side storage apparatus, a logical volume that satisfies the security level indicated by the specified security level information.

14. The management computer according to claim 13, wherein the processor instructs the storage apparatus including the copy source logical volume to encrypt data in the copy source logical volume and send the encrypted data to the selected logical volume.

15. The management computer according to claim 9,

wherein the first table associates each application program executed by each host computer with application security level information that indicates the security level required by the application program and information that indicates the performance level required by the application program;

wherein the second table associates each logical volume with volume security level information that indicates the security level in the logical volume and performance level information that indicates the performance level in the logical volume; and

wherein the processor specifies, based on the second association information, security level information and performance level information required by the specified application program, and selects, from the logical volumes, a logical volume that satisfies the security level and the performance level indicated by the specified security level information and performance level information.

16. A system including plural host computers, plural storage apparatuses, and a management computer,

wherein the host computers are connected to the storage apparatus via a first network;

the host computers, the storage apparatus, and the management computer are connected mutually via a second network;

each host computer is designed to execute an application program; and

each storage apparatus has plural logical volumes,

wherein the management computer comprises;

memory for storing first association information for associating each application program with application security level information that indicates a security level required by the application program, and second association information for associating each logical volume with logical volume security level information that indicates a security level in the logical volume;

an interface for receiving a logical volume allocation request specifying an application program; and

a processor for specifying, based on the first association information, application security level information that indicates the security level required by the application program specified by the logical volume allocation request, and selects, based on the second association information, from the logical volumes, a logical volume that satisfies the security level indicated by the thus specified application security level information.