Method and apparatus for controlling access to storage device

• US 7,130,978 B2
• Filed: 04/21/2004
• Issued: 10/31/2006
• Est. Priority Date: 05/24/2000
• Status: Expired due to Term

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Takamoto, Kenichi, Kamano, Toshimitsu
• Primary Examiner(s): Bragdon, Reginald G.
• Assistant Examiner(s): DINH, NGOC V
• Application Number:
  US10/828,299
• Publication Number:
  US 20040199736A1
• Time in Patent Office: 923 Days
• Field of Search: 711/163, 711/164, 711/112, 711/114, 713/200, 713/201, 713/202, 709/217, 709/219, 709/224, 709/225
• US Class Current: 711/163
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 2003/0697 device management, e.g. handlers, drivers, I/O schedulers
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06F 3/0605 by facilitating the interaction with a user or administrator
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0661 Format or protocol conversion arrangements
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

The storage regions under command of a storage controller can be simply enabled and disabled to access to by automatically registering connected host computers. Such system can be achieved by taking a step of acquiring N_Port_Name information included in a login frame from the host computers, and a step of displaying a table of access right of host computers to a logical unit under command of storage controller. A security table for the storage controller can be generated by supervisor'"'"'s setting the access enable/disable flag information.

Claims

1. A storage system comprising:

a control unit for receiving a data write request from a plurality of host computers which configure a plurality of host groups; and

at least one storage unit coupled to said control unit, said storage unit has a plurality of storage regions for storing data,

wherein said control unit has security information indicating relationships between each of said host groups and each of said storage regions accessible for each of said host groups;

wherein said security information is used by said control unit to reject accesses from other host groups other than each of said host groups that are permitted to access to each of said storage regions,

wherein said control unit receives a Port Login (PLOGI) frame from a new host computer which is newly coupled to said control unit, and acquires a World Wide Name (WWN) and a source identifier (S_ID) contained in said PLOGI frame from said PLOGI frame so that an administrator can select a storage region of said plurality of storage regions to be accessed from a host group to which said new host computer belongs by using said acquired WWN,

wherein setting/alteration of access permit/deny to storage regions from said host computers is carried out on an identifier basis, said identifier being selectable to be either an identifier designating a plurality of host computers collectively, or an identifier designating one of said host computers,

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating a plurality of host computers is selected, collectively is selected, the identifier designating said host computers collectively including said new host computer and storage regions are displayed on a display, and

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating one of said host computers is selected, the identifier designating said new host computer and storage regions are displayed on the display.

2. A storage system according to claim 1, wherein said control unit sends Accept (ACC) frame or Link Service Reject (LS_RJT) frame based on said received PLOGI frame.

3. A storage system according to claim 1, wherein said new host computer is newly started up.

4. A storage system according to claim 1, wherein said control unit generates data to display said acquired WWN of said new host computer.

5. A storage system according to claim 1, wherein said control unit provides data to display a table which is relationships between said host group belonging to said new host computer and said storage region to be accessed from said host group belonging to said newly host computer.

6. A storage system according to claim 1, wherein said administrator can select an access enable right for said new host computer to access said storage region of said plurality of storage regions.

7. A storage system according to claim 1, wherein said storage region is a logical unit.

8. A storage system comprising:

a control unit for receiving a data write request from a plurality of host computers which configure a plurality of host groups; and

at least one storage unit coupled to said control unit, said storage unit has a plurality of storage regions for storing data,

wherein said control unit has security information indicating relationships between each of said host groups and each of said storage regions accessible for each of said host groups,

wherein said security information is used by said control unit to reject accesses from other host groups other than each of said host groups that are permitted to access to each of said storage regions,

wherein said control unit receives a Port Login (PLOGI) frame from a new host computer which is newly coupled to said storage control unit, and acquires a source identifier (S_ID) contained in said PLOGI frame from said PLOGI frame so that an administrator can select a storage region of said plurality of storage regions to be accessed from a host group belonging to said new host computer,

wherein setting/alteration of access permit/deny to storage regions from said host computers is carried out on an identifier basis, said identifier being selectable to be either an identifier designating a plurality of host computers collectively, or an identifier designating one of said host computers,

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating a plurality of host computers collectively is selected, the identifier designating said host computers collectively including said new host computer and storage regions are displayed on a display, and

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating one of said host computers is selected, the identifier designating said new host computer and storage regions are displayed on the display.

9. A storage system according to claim 8, wherein said control unit sends Accept (ACC) frame or Link Service Reject (LS_RJT) frame based on said received PLOGI frame.

10. A storage system according to claim 8, wherein said new host computer is newly started up.

11. A storage system according to claim 8, wherein said control unit acquires a World Wide Name (WWN) contained in said PLOGI frame from said PLOGI frame and generates data to display said acquired WWN of said new host computer.

12. A storage system according to claim 8, wherein said control unit provides data to display a table which is relationships between said host group belonging to said new host computer and said storage region to be accessed from said host group belonging to said new host computer.

13. A storage system according to claim 8, wherein said administrator can select an access enable right for said new host computer to access said storage region of said plurality of storage regions.

14. A storage system according to claim 8, wherein said storage region is a logical unit.

15. A storage system according to claim 8, wherein said control unit acquires a World Wide Name (WWN) contained in said PLOGI frame from said PLOGI frame.

16. A storage system comprising:

a control unit coupled to a network, said control unit receives a data write request from a plurality of host computers which configure a plurality of host groups; and

at least one storage unit coupled to said control unit, said storage unit has a plurality of logical units for storing data;

wherein said control unit receives a Port Login (PLOGI) frame from a new host computer which is newly coupled to said network, acquires a source identifier (S_ID) contained in said PLOGI frame from said PLOGI frame, and provides data to display relationships between a new host group belonging to said new host computer and a logical unit of said plurality of logical units to be accessed from said new host group,

wherein setting/alteration of access permit/deny to storage regions from said host computers is carried out on an identifier basis, said identifier being selectable to be either an identifier designating a plurality of host computers collectively, or an identifier designating one of said host computers,

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating a plurality of host computers collectively is selected, the identifier designating said host computers collectively including said new host computer and storage regions are displayed on a display, and

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating one of said host computers is selected, the identifier designating said new host computer and storage regions are displayed on the display.

17. A storage system according to claim 16, wherein said control unit sends Accept (ACC) frame or Link Service Reject (LS_RJT) frame based on said received PLOGI frame.

18. A storage system according to claim 16, wherein said new host computer is newly started up.

19. A storage system according to claim 16, wherein said control unit acquires a World Wide Name (WWN) contained in said PLOGI frame from said PLOGI frame and generates data to display said acquired WWN of said new host computer.

20. A storage system according to claim 16, wherein said control unit makes state that an administrator can select an access enable right for said new host group to access said logical unit of said plurality of logical units.

21. A storage system according to claim 16, wherein said storage control unit acquires a World Wide Name (WWN) contained in said PLOGI frame from said PLOGI frame.

22. A storage system comprising:

a control unit for receiving a data write request from a plurality of host computers which configure a plurality of host groups; and

at least one storage unit coupled to said control unit, said storage unit has a plurality of storage regions for storing data,

wherein said control unit has security information indicating relationships between each of said host groups and each of said storage regions accessible for each of said host groups,

wherein said security information is used by said control unit to reject accesses from other host groups other than each of said host groups that are permitted to access to each of said storage regions,

wherein said control unit receives a Port Login (PLOGI) frame from a new host computer which is newly coupled to said control unit, and acquires a World Wide Name (WWN) and a source identifier (S_ID) contained in said PLOGI frame from said PLOGI frame so that an administrator can select a storage region of said plurality of storage regions to be accessed from a new host group to which said new host computer belongs by using said acquired WWN,

wherein said administrator can select a storage region of said plurality of storage regions to not be accessed from said new host group by using said acquired WWN,

wherein setting/alteration of access permit/deny to storage regions from said host computers is carried out on an identifier basis, said identifier being selectable to be either an identifier designating a plurality of host computers collectively, or an identifier designating one of said host computers,

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating a plurality of host computers collectively is selected, the identifier designating said host computers collectively including said new host computer and storage regions are displayed on a display, and

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating one of said host computers is selected, the identifier designating said new host computer and storage regions are displayed on the display.

23. A storage system according to claim 22, wherein said control unit sends Accept (ACC) frame or Link Service Reject (LS_RJT) frame based on said received PLOGI frame.

24. A storage system according to claim 22, wherein said new host computer is newly started up.

25. A storage system according to claim 22, wherein said control unit generates data to display said acquired WWN of said new host computer.

26. A storage system according to claim 22, wherein said control unit provides data to display a table which is relationships between said host group belonging to said new host computer and said storage region to be accessed from said host group belonging to said new host computer.

27. A storage system according to claim 22, wherein said administrator can select an access enable right for said new host computer to access said storage region of said plurality of storage regions.

28. A storage system according to claim 22, wherein said storage region is a logical unit.

29. A storage system comprising:

a control unit for receiving a data write request from a plurality of host computers which configure a plurality of host groups; and

at least one storage unit coupled to said control unit, said storage unit has a plurality of storage regions for storing data,

wherein said control unit has security information indicating relationships between each of said host groups and each of said storage regions accessible for each of said host groups,

wherein said security information is used by said control unit to reject accesses from other host groups other than each of said host groups that are permitted to access to each of said storage regions,

wherein said control unit receives a Port Login (PLOGI) frame from a new host computer which is newly coupled to said control unit, and acquires a source identifier (S_ID) contained in said PLOGI frame from said PLOGI frame so that an administrator can select a storage region of said plurality of storage regions to be accessed from a new host group belonging to said new host computer,

wherein said administrator can select a storage region of said plurality of storage regions to not be accessed from said new host group,

wherein setting/alteration of access permit/deny to storage regions from said host computers is carried out on an identifier basis, said identifier being selectable to be either an identifier designating a plurality of host computers collectively, or an identifier designating one of said host computers,

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating a plurality of host computers collectively is selected, the identifier designating said host computers collectively including said new host computer and storage regions are displayed on a display, and

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating one of said host computers is selected, the identifier designating said new host computer and storage regions are displayed on the display.

30. A storage system according to claim 29, wherein said control unit sends Accept (ACC) frame or Link Service Reject (LS_RJT) frame based on said received PLOGI frame.

31. A storage system according to claim 29, wherein said new host computer is newly started up.

32. A storage system according to claim 29, wherein said control unit acquires a World Wide Name (WWN) contained in said PLOGI frame from said PLOGI frame and generate data to display said acquired WWN of said new host computer.

33. A storage system according to claim 29, wherein said control unit provides data to display table which is relationships between said host group belonging to said new host computer and said storage region to be accessed from said host group belonging to said new host computer.

34. A storage system according to claim 29, wherein said administrator can select an access enable right for said new host computer to access said storage region of said plurality of storage regions.

35. A storage system according to claim 29, wherein said storage region is a logical unit.

36. A storage system according to claim 29, wherein said control unit acquires a World Wide Name (WWN) contained in said PLOGI frame from said PLOGI frame.

37. A storage system comprising:

a control unit coupled to a network, said control unit receives a data write request from a plurality of host computers which configure a plurality of host groups; and

at least one storage unit coupled to said control unit, said storage unit has a plurality of logical units for storing data,

wherein said control unit receives a Port Login (PLOGI) frame from a new host computer which is newly coupled to said network, acquires a source identifier (S_ID) contained in said PLOGI frame from said PLOGI frame, and provides data to display relationships between a new host group belonging to said new host computer and a logical unit of said plurality of logical units to be accessed from said new host group,

wherein an administrator can select a storage region of said plurality of storage regions to not be accessed from said new host group,

wherein setting/alteration of access permit/deny to storage regions from said host computers is carried out on an identifier basis, said identifier being selectable to be either an identifier designating a plurality of host computers collectively, or an identifier designating one of said host computers,

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating a plurality of host computers collectively is selected, the identifier designating said host computers collectively including said new host computer and storage regions are displayed on a display, and

wherein when setting/alteration of access permit/deny to storage regions using an identifier designating one of said host computers is selected, the identifier designating said new host computer and storage regions are displayed on the display.

38. A storage system according to claim 37, wherein said control unit sends Accept (ACC) frame or Link Service Reject (LS_RJT) frame based on said received PLOGI frame.

39. A storage system according to claim 37, wherein said new host computer is newly started up.

40. A storage system according to claim 37, wherein said control unit acquires a World Wide Name (WWN) contained in said PLOGI frame from said PLOGI frame and generate data to display said acquired WWN of said new host computer.

41. A storage system according to claim 37, wherein said control unit makes state that an administrator can select an access enable right for said new host group to access said logical unit of said plurality of logical units.

42. A storage system according to claim 37, wherein said control unit acquires a World Wide Name (WWN) contained in said PLOGI frame from said PLOGI frame.