Apparatus and method for implementing spoofing-and replay-attack-resistant virtual zones on storage area networks

• US 6,823,453 B1
• Filed: 10/06/2000
• Issued: 11/23/2004
• Est. Priority Date: 10/06/2000
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Hagerman, Douglas L.
• Primary Examiner(s): Darrow, Justin T.
• Application Number:
  US09/680,740
• Time in Patent Office: 1,509 Days
• Field of Search: 713/153, 713/162, 713/160, 713/168, 713/194, 713/190, 380/211, 709/217, 709/225
• US Class Current: 713/162
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A storage area network resistant to spoofing attack has several nodes each having a port, and storage area network interconnect interconnecting the ports. Each port is provided with a hash function generator for providing and verifying an authentication code for frames transmitted over the storage area network, and a key table for providing a key to the hash function generator. The authentication code is generated by applying a hash function to the key and to at least an address portion of each frame. In each node, the key is selected from that node'"'"'s key table according to address information of the frame.

Claims

1. A storage area network resistant to spoofing attack comprising:

at least a first compute node having a port and a first storage node having a port;

storage area network interconnect interconnecting the port of the first compute node and the port of the first storage node;

a first hash function generator for providing an authentication code for a frame transmitted over the storage area network from the port of the first compute node;

a first key table for providing a key to the first hash function generator, the authentication code being generated by applying a hash function to the key and to at least a portion of the frame;

a second hash function generator for verifying the authentication code upon receipt at the port of the first storage node; and

a second key table for providing a key to the second hash function generator, the authentication code being verified by applying a hash function to the key and to at least a portion of the frame, the key being selected according to a source identifier of the frame.

2. The network of claim 1, wherein the frame encapsulates a SCSI command over Fibre Channel.

3. The network of claim 1 wherein the frame further comprises an association header, the portion of the frame used to generate the authentication code comprising at least a portion of the association header, and wherein the key of the second hash function generator is selected according to at least a portion of the association header in addition to a source identifier of the frame.

4. The network of claim 1, wherein the first compute node further comprises a clock, and wherein the frame further comprises a transmit time field.

5. The network of claim 1, further comprising at a second compute node having a port;

wherein the storage area network interconnect interconnects the port of the second compute node and the port of the first storage node in addition to interconnecting the port of the first compute node and the port of the first storage node;

wherein the second compute node has a third key table not identical to the first key table, the differences between the first key table and the second key table operative to establish zoning on the network.

6. The network of claim 5, wherein the first compute node further comprises a clock, and wherein the frame further comprises a transmit time field.

7. A node for use in a storage area network comprising:

a hash function generator operable to generate an authentication code for a frame capable of transmission on the storage area network;

a key table coupled to provide a key to the hash function generator, the key being a function of at least a destination address of the frame;

a clock coupled to generate a transmission timestamp for the frame;

a port for transmitting the frame; and

wherein the authentication code is a function of at least the transmission timestamp, the key, the destination address of the frame, and a source address of the frame.

8. The node of claim 7 wherein the authentication code is further a function of the payload of the frame.

9. The node of claim 7,

wherein the port is capable of receiving a second frame;

wherein the key table is capable of selecting a receive key to the hash function generator based upon at least a source address of the second frame,

wherein the hash function generator is capable of verifying an authentication code of the second frame based upon at least the receive key, a transmission timestamp, a destination address, and a source address of the second frame.

10. The node of claim 9, wherein the node is capable of dropping frames upon the hash function generator failing to verify an authentication code.

11. The node of claim 9, wherein the receive key is capable of being selected according to a destination process identifier of an association header as well as the source address of the second frame.

12. The node of claim 9, wherein the port is capable of rejecting frames that have a timestamp that is outside a window of time relative to previously received frames having identical source identifier fields.

13. The node of claim 12, wherein the port is capable of rejecting frames having identical transmit timestamps to previously received frames having identical source identifier fields.