Security for logical unit in storage subsystem

• US 7,051,167 B2
• Filed: 08/02/2004
• Issued: 05/23/2006
• Est. Priority Date: 07/13/2001
• Status: Expired due to Term

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Okami, Yoshinori, Hori, Koichi, Igarashi, Yoshinori, Uchiumi, Katsuhiro, Ito, Ryuske
• Primary Examiner(s): Ellis, Kevin L.
• Assistant Examiner(s): Doan, Duc T
• Application Number:
  US10/902,794
• Publication Number:
  US 20050005064A1
• Time in Patent Office: 659 Days
• Field of Search: 711/112
• US Class Current: 711/152
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Tables (FIGS. 11 and 12) for stipulating information (WWN: WorldWide Name) for primarily identifying computers, information (GID: Group ID) for identifying a group of the computers and a logical unit number (LUN) permitting access from the host computer inside storage subsystem, in accordance with arbitrary operation method by a user, and for giving them to host computer. The invention uses management table inside the storage subsystem and gives logical unit inside storage subsystem to host computer group arbitrarily grouped by a user in accordance with the desired form of operation of the user, can decide access approval/rejection to the logical unit inside the storage subsystem in the group unit and at the same time, can provide the security function capable of setting interface of connection in the group unit under single port of storage subsystem without changing existing processing, limitation and other functions of computer.

Claims

1. A storage system adapted to be coupled to a plurality of host computers, said storage system comprising:

a plurality of disk drives storing data from said host computers, said disk drives forming a plurality of logical units, said logical units each having a logical unit number; and

a controller having an access management map,

wherein said access management map includes an identification of a host group having some of said host computers selected from said host computers by an user and a plurality of virtual logical unit numbers each being a renumbered identification of one of said logical unit numbers, and is used to control access from said host group to said logical units.

2. The storage system according to claim 1, wherein said access management map permits mapping of different logical unit numbers to the same virtual logical unit number for different host groups.

3. The storage system according to claim 1, wherein said access management map does not permit mapping of different logical unit numbers to one host group at the same virtual logical unit number.

4. The storage system according to claim 1, wherein said virtual logical unit numbers, each being a renumbered identification of one of said logical unit numbers, allocated to each host group begins with 0.

5. The storage system according to claim 1, wherein said virtual logical unit numbers, each being a renumbered identification of one of said logical unit numbers allocated to each host group begins with 0 and increments by 1.

6. The storage system according to claim 1, wherein each of said virtual logical unit numbers is specified by a user.

7. The storage system according to claim 1, wherein said storage system has interface information corresponding to said host group.

8. The storage system according to claim 7, wherein said interface information is the reception to Input/Output, the depth of a reception queue, or the response content of Inquiry.

9. A storage system adapted to be coupled to a plurality of host computers, said storage system comprising:

a plurality of disk drives storing data from said host computers, said disk drives forming a plurality of logical units, said logical units each having a logical unit number; and

a controller having an access management table,

wherein said access management table includes an identification of a host group having some of said host computers selected from said host computers by an user and a plurality of virtual logical unit numbers each being a renumbered identification of one of said logical unit numbers, and is used to control access from said host group to said logical units.

10. The storage system according to claim 9, wherein said access management table permits mapping of different logical unit numbers to the same virtual logical unit number for different host groups.

11. The storage system according to claim 9, wherein said access management map does not permit mapping of different logical unit numbers to one host group at the same virtual logical unit number.

12. The storage system according to claim 9, wherein said virtual logical unit numbers, each being a renumbered identification of one of said logical unit numbers, allocated to each host group begins with 0.

13. The storage system according to claim 9, wherein said virtual logical unit numbers, each being a renumbered identification of one of said logical unit numbers, allocated to each host group begins with 0 and increments by 1.

14. The storage system according to claim 9, wherein each of said virtual logical unit numbers is specified by a user.

15. The storage system according to claim 9, wherein said storage system has interface information corresponding to said host group.

16. The storage system according to claim 15, wherein said interface information is the reception to Input/Output, the depth of a reception queue, or the response content of Inquiry.

17. A storage system adapted to be coupled to a plurality of host computers, said storage system comprising:

a plurality of disk drives storing data from said host computers, said disk drives forming a plurality of logical units, said logical units each having a logical unit number; and

a controller controlling read/write of data from/to said disk drives in response to access from said host computers to said logical units,

wherein said controller has an access management map which includes an identification of a host group having some of said host computers selected from said host computers by a user and a plurality of virtual logical unit numbers each being a renumbered identification of one of said logical unit numbers, and is used to control access from said host group to said logical units.

18. The storage system according to claim 17, wherein said access management map permits mapping of different logical unit numbers to the same virtual logical unit number for different host groups.

19. The storage system according to claim 17, wherein said access management map does not permit mapping of different logical unit numbers to one host group at the same virtual logical unit number.

20. The storage system according to claim 17, wherein said virtual logical unit numbers, each being a renumbered identification of one of said logical unit numbers, allocated to each host group begins with 0.

21. The storage system according to claim 17, wherein said virtual logical unit numbers, each being a renumbered identification of one of said logical unit numbers, allocated to each host group begins with 0 and increments by 1.

22. The storage system according to claim 17, wherein each of said virtual logical unit numbers is specified by a user.

23. The storage system according to claim 17, wherein said storage system has interface information corresponding to said host group.

24. The storage system according to claim 23, wherein said interface information is the reception to Input/Output, the depth of a reception queue, or the response content of Inquiry.

25. A storage system adapted to be coupled to a plurality of host computers, said storage system comprising:

a plurality of disk drives storing data from said host computers, said disk drives forming a plurality of logical units, said logical units each having a logical unit number; and

a controller controlling read/write of data from/to said disk drives in response to accesses from said host computers to said logical units,

wherein said controller has an access management table which includes an identification of a host group having some host computers selected from said host computers by a user and a plurality of virtual logical unit numbers each being a renumbered identification of one of said logical unit numbers, and is used to control access from said host group to said logical units.

26. The storage system according to claim 25, wherein said access management table permits mapping of different logical unit numbers to the same virtual logical unit number renumbered identification for different host groups.

27. The storage system according to claim 25, wherein said access management map does not permit mapping of different logical unit numbers to one host group at the same virtual logical unit number.

28. The storage system according to claim 25, wherein said virtual logical unit numbers, each being a renumbered identification of one of said logical unit numbers, allocated to each host group begins with 0.

29. The storage system according to claim 25, wherein said virtual logical unit numbers, each being a renumbered identification of logical unit numbers allocated to each host group begins with 0 and increments by 1.

30. The storage system according to claim 25, wherein said virtual logical unit numbers is specified by a user.

31. The storage system according to claim 25, wherein said storage system has interface information corresponding to said host group.

32. The storage system according to claim 31, wherein said interface information is the reception of Input/Output, the depth of a reception queue, or the response content of Inquiry.

33. A storage system adapted to be coupled to a plurality of host computers, said storage system comprising:

a plurality of disk drives storing data from said host computers, said disk drives forming a plurality of logical units, said logical units each having a logical unit number; and

a controller controlling read/write of data from/to said disk drives in response to accesses from said host computers to said logical units;

wherein said controller includes an access management map which includes an identification of a host group having some of said host computers selected from said host computers by a user and a plurality of virtual logical unit numbers each being a renumbered identification of one of said logical units, and is used to control access from said host group to said logical units, and

wherein said controller controls access from said host group to said logical unit in accordance with said access management map.

34. The storage system according to claim 33, wherein said access management map permits mapping of different logical unit numbers to the same virtual logical unit number for different host groups.

35. The storage system according to claim 33, wherein said access management map does not permit mapping of different logical unit numbers to one host group at the same virtual logical unit number.

36. The storage system according to claim 33, wherein said virtual logical unit numbers, each being a renumbered identification of one of said logical unit numbers, allocated to each host group begins with 0.

37. The storage system according to claim 33, wherein said virtual logical unit numbers, each being a renumbered identification of one of said logical unit numbers, allocated to each host group begins with 0 and increments by 1.

38. The storage system according to claim 33, wherein each of said virtual logical unit numbers is specified by a user.

39. The storage system according to claim 33, wherein said storage system has interface information corresponding to said host group.

40. The storage system according to claim 39, wherein said interface information is the reception to Input/Output, the depth of a reception queue, or the response content of Inquiry.

41. A storage system adapted to be coupled to a plurality of host computers, said storage system comprising:

a plurality of disk drives storing data from said host computers, said disk drives forming a plurality of logical units, said logical units each having a logical unit number; and

a controller controlling read/write of data from/to said disk drives in response to accesses from said host computers to said logical units;

wherein said controller includes an access management table includes an identification of a host group having some host computers selected from said host computers by a user and a plurality of virtual logical unit numbers each being a renumbered identification of one of said logical units, and is used to control access from said host group to said logical units, and

wherein said controller controls access from said host group to said logical unit in accordance with said access management table.

42. The storage system according to claim 41, wherein said access management table permits mapping of different logical unit numbers to the same virtual logical unit number for different host groups.

43. The storage system according to claim 41, wherein said access management map does not permit mapping of different logical unit numbers to one host group at the same virtual logical unit number.

44. The storage system according to claim 41, wherein said virtual logical unit numbers, each being a renumbered identification of one of said logical unit numbers, allocated to each host group begins with 0.

45. The storage system according to claim 41, wherein said virtual logical unit numbers, each being a renumbered identification of one of said logical unit numbers, allocated to each host group begins with 0 and increments by 1.

46. The storage system according to claim 41, wherein said renumbered identification is specified by a user.

47. The storage system according to claim 41, wherein said storage system has interface information corresponding to said host group.

48. The storage system according to claim 47, wherein said interface information is the reception to Input/Output, the depth of a reception queue, or the response content Inquiry.