Computer system for allocating storage area to computer based on security level

• US 7,099,904 B2
• Filed: 04/21/2004
• Issued: 08/29/2006
• Est. Priority Date: 02/27/2004
• Status: Expired due to Fees

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Hitachi, Ltd.
• Inventors: Nakatsuka, Daiki
• Primary Examiner(s): Corrielus, Jean M.
• Application Number:
  US10/828,287
• Publication Number:
  US 20050192923A1
• Time in Patent Office: 860 Days
• Field of Search: None
• US Class Current: 707/781
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/288 Distributed intermediate devices, i.e. intermediate devices for interaction with other intermediate devices on the same level
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: Y10S 707/959 Network
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99956 File allocation

Abstract

A management server takes charge of managing information about whether a physical port is provided with means for security protection. Based on such information, the management server automatically determines to which physical port a volume is to be assigned. As such, an assignment process is executed.

Claims

1. A computer system, comprising:

a first computer;

a plurality of storage systems coupled to the first computer over a network; and

a second computer coupled to the first computer and the plurality of storage systems,

wherein the first computer sends a request to the second computer,

wherein the second computer has information about security level of the plurality of storage systems, selects, in response to the request from the first computer, one of the plurality of storage system according to the information in the second computer, and transmits a command to the selected one of the plurality of storage systems for creating a logical volume which is constructed on a physical disk device of the one of the plurality of storage systems for use by the first computer based on the request of the first computer,

wherein the one of the plurality of storage systems creates the logical volume in accordance with the command, and forwards a creation completion notice to the second computer, and

wherein after receiving the notice, the second computer notifies the first computer of path information of an access path from the first computer to the logical volume in the one of the Plurality of storage systems created by the one of the plurality of storage systems.

2. A computer system according to claim 1,

wherein the request sent by the first computer to the second computer is a request for creating the logical volume with a high security level.

3. A computer system according to claim 2,

wherein each of the plurality of storage systems has an interface device coupled to the network for communicating with the first computer via the network,

wherein the information about the security level is information about whether or not the interface device in each of the storage systems can execute a ciphered communication with the first computer by using IPSec process, and

wherein the high security level means the interface device in the corresponding storage system is capable of the ciphered communication by using IPSec process.

4. A computer system according to claim 3,

wherein the second computer selects a first storage system, which has a first interface device that can execute a ciphered communication with the first computer by using IPSec process, of the plurality of storage systems if the request indicates to create a first logical volume with which the first computer can communicate with the high security level, and sends a first command to the first storage system,

wherein the first command is a command for interrelating the first logical volume to be created to the first interface device capable of ciphered communication by using the IPSec process in the first storage system,

wherein in accordance with the first command, the first storage system interrelates the created first logical volume to the first interface device capable of the ciphered communication by using the IPSec process, and

wherein the second computer notifies the first computer of address information as the path information in the network assigned to the first interface device capable of the ciphered communication by using the IPSec process.

5. A computer system according to claim 3,

wherein the second computer selects a first storage system, which has a first interface device and a second interface device each of which can execute a ciphered communication with the first computer by using IPSec process, of the plurality of storage systems if the request indicates to create a first logical volume with which the first computer can communicate with the high security level, and sends a first command to the first storage system,

wherein the first command is a command for interrelating the first logical volume to the first and second interface devices capable of the ciphered communication by using the IPSec process in the first storage system,

wherein in accordance with the first command, the first storage system interrelates the created first logical volume to the first and second interface device capable of the ciphered communication by using the IPSec process, and

wherein the second computer notifies the first computer of address information as the path information in the network assigned to each of the first and second interface devices capable of the ciphered communication by using the IPSec process.

6. A computer system according to claim 5,

wherein the second computer further includes second information about first computer coupled to the network that can use the first logical volume in the first storage system,

wherein based on the second information, the second computer transmits, to the first computer having issued the request, the path information to the first logical volume that is available for the first computer.

7. A computer system according to claim 6,

wherein after receiving the notice from the one of the plurality of storage systems, the second computer registers, with the second information, information about the first computer having requested creation of the logical volume when notifying the first computer of the path information about the logical volume created in the one of the Plurality of storage systems.

8. A computer system according to claim 1,

wherein the information about the plurality of storage systems is information about the security level of each of the plurality of storage systems and the first computer,

wherein the request of the first computer is a request for creating the logical volume, and

wherein the second computer checks the security level of the first computer based on the information, selects a first storage system of the Plurality of storage systems meeting the security level of the first computer based on the information, and commands the first storage system to create the logical volume depending on the security level of the first computer.

9. A computer system according to claim 8,

wherein the first computer and each of the plurality of storage systems have an interface device coupled to the network for communicating with each other via the network,

wherein the information about the security level is information about whether or not the interface device in each of the storage systems and the first computer can execute ciphered communication by using an IPSec process, and

wherein when the security level of the first computer is in a level that the first computer has a first interface device which can execute ciphered communication by using the IPSec process, the second computer selects the first storage system which has a second interface device which can execute ciphered communication by using the IPSec process, and commands the first storage system to interrelate logical volume to the second interface device capable of the ciphered communication by using the IPSec process in the first storage system.

10. A computer system according to claim 1,

wherein the information about the storage system is information about whether or not an interface device, which each of the plurality of storage systems has, and used for coupling with the network can execute ciphered communication by using an IPSec process,

wherein the request of the first computer is a request for creating the logical volume,

wherein based on the request for creating the logical volume, the second computer selects a first storage system of the plurality of storage systems that has a first interface device which can execute the ciphered communication by using the IPSec process, and transmits a command to the first storage system for creating the logical volume related to the first interface device capable of the ciphered communication by using the IPSec process in the first storage system,

wherein in accordance with the command, the first storage system creates the logical volume and interrelates the created logical volume to the first interface device capable of the ciphered communication by using the IPSec process, and

wherein the second computer notifies the first computer of address information as the path information in the network assigned to the first interface device capable of the ciphered communication by using the IPSec process.

11. A computer system according to claim 1,

wherein the information about the storage system is information about whether or not an interface device, which each of the plurality of the storage systems has, and used for coupling with the network can execute ciphered communication by using an IPSec process,

wherein the request of the first computer is a request for creating the logical volume,

wherein based on the request for creating the logical volume, the second computer selects a first storage system of the plurality of storage systems which has a first interface device and a second interface device each of which can execute the ciphered communication by using IPSec process, and transmits a command to the first storage system for creating the logical volume,

wherein in accordance with the command, the first storage system creates the logical volume, and interrelates the created logical volume to the first and second interface devices capable of the ciphered communication by using the IPSec process, and

wherein the second computer notifies the first computer of address information as the path information in the network assigned to each of the first and second interface devices capable of the ciphered communication by using the IPSec process.

12. A computer according to claim 1,

wherein the information about the storage system is information about whether or not an interface device, which each of the plurality of storage systems has, and used for coupling with the network can execute ciphered communication by using an IPSec process,

wherein the request of the first computer is a request for creating the logical volume,

wherein based on the request for creating the logical volume, the second computer selects a first storage system which has a first interface device which can execute the ciphered communication by using the IPSec process and has a second interface device which cannot execute the ciphered communication, and transmits a command to the first storage system for creating the logical volume,

wherein in accordance with the command, the first storage system creates the logical volume and interrelates the created logical volume to the first interface device capable of the ciphered communication by using the IPSec process and to the second interface device incapable of the ciphered communication, and

wherein the second computer notifies the first computer of address information as the path information in the network assigned to the first interface device and address information in the network assigned to the second interface device.

13. A computer system according to claim 12,

wherein the first computer selects one address included in the address information received from the second computer to make access to the logical volume in the first storage system.

14. A computer system according to claim 13,

wherein when the first computer is in need of the high security level for a accessing to the logical volume in the first storage system, the first computer selects the address information corresponding to the first interface device capable of the ciphered communication by using the IPSec process to make access to the logical volume in the first storage system.

15. A management computer coupled to a computer and a plurality of storage systems, comprising:

a control section;

a memory; and

an interface to be coupled to a network and being coupled with the computer and the plurality of storage systems,

wherein the memory includes information indicating whether or not an interface device, which each of the plurality of storage systems has to be coupled to the network is capable of ciphered communication by using an IPSec process,

wherein when the computer makes a request to create a logical volume constructed on a physical disk device in one of the plurality of storage systems over the interface, the control section selects a first storage system which has a first interface device which can execute the ciphered communication by using the IPSec, and transmits, to the first storage system, a command for creating the logical volume and interrelating to the first interface device capable of the ciphered communication by using the IPSec process based on the request, and

wherein after receiving a completion notice from the first storage system, the management computer notifies the computer of address information assigned to the first interface device capable of the ciphered communication by using the IPSec process.

16. A computer system, comprising:

a first computer;

a storage system to be coupled with the first computer over a network; and

a second computer to be coupled to the first computer and the storage system,

wherein the first computer sends a request for creating a logical volume constructed on a Physical disk in the storage system to the second computer,

wherein the second computer has information about whether each of a plurality of interface devices in the storage system used for coupling with the network is capable of ciphered communication with the first computer by using an IPSec process, decides, in response to the request the storage system is in accordance with the information in the second computer, and transmits a command to the decided storage system for creating the logical volume and for interrelating the logical volume used by the first computer to one of the plurality of interface devices capable of the ciphered communication by using the IPSec process in the storage system,

wherein the storage system creates the logical volume and interrelates the created logical volume to the one of the plurality of interface devices capable of the ciphered communication by using the IPSec process in accordance with the command, and forwards to the second computer a creation completion notice,

wherein the second computer notifies the first computer of address information in the network assigned to one of the plurality of interface devices capable of the ciphered communication by using the IPSec process,

wherein based on the address information, the first computer makes access to the logical volume in the storage system via the one of the plurality of interface devices capable of the ciphered communication by using the IPSec process.