Method and apparatus for controlling access to storage device

• US 6,968,434 B2
• Filed: 04/30/2003
• Issued: 11/22/2005
• Est. Priority Date: 05/24/2000
• Status: Expired due to Term

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Takamoto, Kenichi, Kamano, Toshimitsu
• Primary Examiner(s): Sparks, Donald
• Assistant Examiner(s): Dinh, Ngoc V.
• Application Number:
  US10/425,915
• Publication Number:
  US 20030196055A1
• Time in Patent Office: 937 Days
• Field of Search: 711/163, 711/164, 709/217, 709/219, 709/224, 709/225, 713/200, 713/201, 713/202
• US Class Current: 711/163
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 2003/0697 device management, e.g. handlers, drivers, I/O schedulers
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06F 3/0605 by facilitating the interaction with a user or administrator
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0661 Format or protocol conversion arrangements
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

The storage regions under command of a storage controller can be simply enabled and disabled to access to by automatically registering connected host computers. Such system can be achieved by taking a step of acquiring N_—Port_—Name information included in a login frame from the host computers, and a step of displaying a table of access right of host computers to a logical unit under command of storage controller. A security table for the storage controller can be generated by supervisor'"'"'s setting the access enable/disable flag information.

Claims

1. A storage system comprising:

a control unit for receiving a data write request from a plurality of host computers;

at least one storage unit coupled to said control unit and having a plurality of storage regions for storing data; and

a panel displaying information of relationships between host group identifiers (IDs) of groups of host computers each group having one or more host computers and said storage regions connected to said groups of host computers,

wherein said control unit has an access security table indicating, a relationship between said groups of host computers and said storage regions accessible to said groups of host computers, and

wherein said panel displays information of a relationship between said host group IDs of groups of host computers and said storage regions accessible to each group of host computers on said panel so that an administrator can set an access enable/disable right for said groups of host computers to permit access or not permit access of said storage regions using said host group IDs without inputting a World Wide Name (WWN) of each of said host computers when said administrator sets said enable/disable right on said panel to be input to said access security table.

2. A storage system according to claim 1, wherein said access security table is made and then said administrator chooses access enable/disable right in a Port Login (PLOGI) sequence.

3. A storage system according to claim 1, wherein Port Login (PLOGI) is acknowledged if there is an access enable right related to at least one of said storage regions corresponding to said host computer which sent a PLOGI frame in said access security table, when said control unit receives said PLOGI frame.

4. A storage system according to claim 3, wherein when said storage control unit receives an INQUIRY command from said host computer, said PLOGI of said host computer is acknowledged, and

wherein said control unit judges if a logical unit number of a storage region in said INQUIRY command matches an access enable right of said access security table, and acknowledges said INQUIRY command from said host computer to said storage region if matches.

5. A storage system according to claim 1, further comprises:

a host information table which sets relations between said WWNs of said host computers and Source Identifiers (S_—

IDs) of said host computers,

wherein said host information table is made at Port Login (PLOGI) sequence.

6. A storage system comprising:

a control unit for receiving a data write request from a plurality of host computers;

at least one storage unit coupled to said control unit and having a plurality of storage regions for storing data,

wherein said control unit has an access security table indicating, with respect to groups of host computers each group having one or more host computers, a relationship between said groups of host computers and said storage regions accessible to said groups of host computers; and

a panel which displays information of a relationship between host group identifiers (IDs) of said groups of host computers and said storage regions accessible to said groups of host computers so that an administrator can set an access enable/disable right for said groups of host computers to permit access or not permit access of said storage regions using said host group (IDs) without inputting a World Wide Name (WWN) of each of said host computes when said administrator sets said enable/disable right on said panel to be input to said access security table.

7. A storage system according to claim 6, wherein said access security table is made and then said administrator chooses access enable/disable right in a Port Login (PLOGI) sequence.

8. A storage system according to claim 6, wherein Port Login (PLOGI) is acknowledged if there is an access enable right related to at least one of said storage regions corresponding to said host computer which sent a PLOGI frame in said access security table, when said control unit receives said PLOGI frame.

9. A storage system according to claim 8, wherein when said control unit receives an INQUIRY command from said host computer, said PLOGI of said host computer is acknowledged, and

wherein said control unit judges if a logical unit number of a storage region in said INQUIRY command matches an access enable right of said access security table, and acknowledges said INQUIRY command from said host computer to said storage region if matches.

10. A storage system according to claim 6, further comprises:

a host information table which sets relations between said WWNs of said host computers and Source Identifiers (S_—

IDs) of said host computers,

wherein said host information table is made at Port Login (PLOGI) sequence.

11. A storage system comprising:

a control unit for receiving a data write request from a plurality of host computers of different vendors;

at least one storage unit coupled to said control unit and having a plurality of storage regions for storing data; and

a panel displaying information of relationship between host group identifiers (IDs) of vendors of said host computers and said storage regions connected to each vendor,

wherein said control unit has an access security table indicating a relationship between each vendor and each of said storage regions accessible to each vendor, and

wherein said panel displays information of relationship between said host group IDs of said vendors and said storage regions accessible to each vendor on said panel so that an administrator can set an access enable/disable right for each vendor to permit access or not permit access of each of said storage regions without inputting a World Wide Name (WWN) of each of said host computers when said administrator sets said enable/disable right on said panel to be input to said access security table.

12. A storage system according to claim 11, wherein said access security table is made and then said administrator chooses access enable/disable right in a Port Login (PLOGI) sequence.

13. A storage system according to claim 11, wherein Port Login (PLOGI) is acknowledged if there is an access enable right related to at least one of said storage regions corresponding to said host computer which sent a PLOGI frame in said access security table, when said control unit receives said PLOGI frame.

14. A storage system according to claim 13, wherein when said control unit receives an INQUIRY command from said host computer, said PLOGI of said host computer is acknowledged, and

wherein said storage control unit judges if a logical unit number of a storage region in said INQUIRY command matches an access enable right of said access security table, and acknowledges said INQUIRY command from said host computer to said storage region if matches.

15. A storage system according to claim 11, further comprises:

a host information table which sets relations between said WWNs of said host computers and Source Identifiers (S_—

IDs) of said host computers,

wherein said host information table is made at Port Login (PLOGI) sequence.

16. A storage system comprising:

a control unit for receiving a data write request from a plurality of host computers having different file formats;

at least one storage unit coupled to said control unit and having a plurality of storage regions for storing data; and

a panel displaying information of relationship between host group identifiers (IDs) corresponding to file format information of said host computers and said storage regions connected to each of said host computers,

wherein said control unit has an access security table indicating relationship between each file format information of said host computers and each of said storage regions accessible to each of said host computers, and

wherein said panel displays information of relationship between host group IDs corresponding to file format information of said host computers and said storage regions accessible to each of said host computers on said panel so that an administrator can set an access enable/disable right for each file format information of said host computers to permit access or not permit access of each of said storage regions without inputting a World Wide Name (WWN) of each of said host computers when said administrator sets said enable/disable right on said panel to be input to said access security table.

17. A storage system according to claim 16, wherein said access security table is made and then said administrator chooses access enable/disable right in a Port Login (PLOGI) sequence.

18. A storage system according to claim 16, wherein Port Login (PLOGI) is acknowledged if there is an access enable right related to at least one of said storage regions corresponding to said host computer which sent a PLOGI frame in said access security table, when said control unit receives said PLOGI frame.

19. A storage system according to claim 18, wherein when said control unit receives an INQUIRY command from said host computer, said PLOGI of said host computer is acknowledged, and

wherein said control unit judges if a logical unit number of a storage region in said INQUIRY command matches an access enable right of said access security table, and acknowledges said INQUIRY command from said host computer to said storage region if matches.

20. A storage system according to claim 16, further comprises:

a host information table which sets relations between said WWNs of said host computers and Source Identifiers (S_—

IDs) of said host computers,

wherein said host information table is made at Port Login (PLOGI) sequence.

21. A storage system comprising:

a control unit for receiving a data write request from a plurality of host computers having different Operating Systems (OS'"'"'s);

at least one storage unit coupled to said control unit and having a plurality of storage regions for storing data; and

a panel displaying information of relationship between host group identifiers (IDs) corresponding to OS of said host computers and said storage regions connected to each of said host computers,

wherein said control unit has an access security table indicating relationship between each OS of said host computers and each of said storage regions accessible to each of said host computers, and

wherein said panel displays information of relationship between host group IDs corresponding to OSs of said host computers and said storage regions accessible to each of said host computers on said panel so that an administrator can set an access enable/disable right for each OS of said host computers to permit access or not permit access of each of said storage regions without inputting a World Wide Name (WWN) of each of said host computers when said administrator sets said enable/disable right on said panel to be input to said access security table.

22. A storage system according to claim 21, wherein said access security table is made and then said administrator chooses access enable/disable right in a Port Login (PLOGI) sequence.

23. A storage system according to claim 21, wherein Port Login (PLOGI) is acknowledged if there is an access enable right related to at least one of said storage regions corresponding to said host computer which sent a PLOGI frame in said access security table, when said control unit receives said PLOGI frame.

24. A storage system according to claim 23, wherein when said control unit receives an INQUIRY command from said host computer, said PLOGI of said host computer is acknowledged, and

wherein said storage control unit judges if a logical unit number of a storage region in said INQUIRY command matches an access enable right of said access security table, and acknowledges said INQUIRY command from said host computer to said storage region if matches.

25. A storage system according to claim 21, further comprises:

a host information table which sets relations between said WWNs of said host computers and Source Identifiers (S_—

IDs) of said host computers,

wherein said host information table is made at Port Login (PLOGI) sequence.