Method and apparatus for setting access restriction information

• US 7,373,670 B2
• Filed: 02/27/2004
• Issued: 05/13/2008
• Est. Priority Date: 11/26/2003
• Status: Expired due to Fees

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Yamamoto, Masayuki, Mimatsu, Yasuyuki, Shimooka, Kenichi
• Primary Examiner(s): Sheikh; Ayaz
• Assistant Examiner(s): DOAN, TRANG T
• Application Number:
  US10/787,112
• Publication Number:
  US 20050114693A1
• Time in Patent Office: 1,537 Days
• Field of Search: None
• US Class Current: 726/27
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 3/0607 by facilitating the process of upgrading existing storage systems, e.g. for improving compatibility between host and storage device
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: Y10S 707/99936 Pattern matching access
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/9994 Distributed or remote access

Abstract

Access restriction information that an old storage device has is transferred to a new storage device. A management server 2200 obtains a port management TL 2445 that the old storage device 2400 has, through a LAN 2600 which is separated from a Fiber Channel network which is utilized for data communication. Also, through the LAN 2600, a port list TL 2555 is obtained from the new storage device 2500. And, then, on the basis of the port list TL 2555, a port of the new storage device 2500, which is utilized for an access to a volume of the old storage device, is selected. And, on the basis of the port management TL 2445, on a port of the selected new storage device 2500, it is set up that access restriction information of a port of the old storage device 2400 to which a volume, of which the port is utilized for an access, is assigned.

Claims

1. An access restriction information setting method which sets up access restriction information on a storage device, in a storage area network system having the storage device which determines whether or not an access request to a volume is permitted in accordance with access restriction information which is set up on a port which receives the request, and a plurality of host computers which transmit access requests to said storage device through a first network, comprising:

a first step for obtaining first access restriction information and information of a volume which are set up on each port of a first storage device, through a second network, said first access restriction information including information of access permission from a first host computer and access denial from a second host computer;

a second step for obtaining attribute information including a port type and a status of utilization of each port of a second storage device, from said second storage device through said second network;

a third step for selecting a target port of said second storage device which is utilized for reception of an access request to a volume of said first storage device from said first host computer; and

a fourth step for setting up, on the target port of said second storage device which is selected in said third step, second access restriction information based on said first access restriction information of a port of said first storage device to which a volume, of which the port is utilized for an access, is assigned so that said first host computer is permitted to access said first storage device via the target port of said second storage device, while said second host computer is not permitted to access said first storage device via the target port of said second storage device.

2. An access restriction information setting method according to claim 1, wherein

said third step selects an initiator port which is utilized for transmission of an access request to a volume of said first storage device from said second storage device, and

said fourth step sets up, on the target port of said second storage device which is selected in said third step, the second access restriction information of the port of said first storage device to which the volume, of which the port is utilized for an access, is assigned, and permits only an access request to the first access restriction information of said first storage device to which the volume is assigned from the initiator port of said second storage device which is selected in said third step.

3. An access restriction information setting method according to claim 1, wherein

said first step obtains the first access restriction information which is set up on each port of a first storage device and information of a volume, from said first storage device through said second network.

4. An access restriction information setting method according to claim 1, wherein

said first step specifies the first access restriction information which is set up on each port of a first storage device and information of the volume, by obtaining information of a port of one of said host computers which is utilized for an access to the volume of said first storage device and information of the port of said first storage device, from said one of said host computers through said second network.

5. An access restriction information setting method according to claim 1, further comprising:

a fifth step for changing a port of said first storage device which is associated with each mount point of a file system of said host computer and a volume which is assigned to the port, to a port of said second storage device which is utilized for an access to the volume and a volume which is defined on the port.

6. An access restriction information setting method according to claim 1, wherein

said first storage device sets up first access restriction information on each port, by use of a first management table in which an information identifier of a volume and a source port of an access to be permitted are listed with a LUN unit with respect to each port, and

said second storage device sets up second access restriction information on each port, by use of a second management table in which a LUN and an identifier of a volume are listed with a group unit of source ports of an access to be permitted with respect to each port, and

said first step obtains said first management table, and

said fourth step prepares said second management table as to each port of said second storage device which is selected in said third step, on the basis of a listed content of said first management table which is obtained in said first step as to each port of said first storage device to which a volume, of which said port is utilized for an access, is assigned, and updates said second management table of said second storage device.

7. An access restriction information setting method according to claim 1, wherein

in case that one of said host computers has a plurality of paths which are used for an access to the same volume, a process of said fourth step to the volume is carried out at least twice separately to said plurality of paths.

8. An access restriction information setting method according to claim 1, wherein

said second network is different from said first network.

20. An access restriction information setting method according to claim 7, wherein

the access control information sets up for each path as to whether the access is permitted or not permitted.

9. An access restriction information setting apparatus which sets up access restriction information on a storage device, in a storage area network system having the storage device which determines whether or not an access request to a volume is permitted in accordance with access restriction information which is set up on a port which receives the request, and in a plurality of host computers which transmit access requests to said storage device through a first network, comprising:

an obtaining unit which obtains first access restriction information and information of a volume which are set up on each port of a first storage device, and attribute information including a port type and a status of utilization of each port of a second storage device, through a second network, said first access restriction information including information of access permission from a first host computer and access denial from a second host computer;

a selecting unit which selects a target port of said second storage device which is utilized for reception of an access request to a volume of said first storage device from said host computer; and

a setting unit which sets up, on the target port of said second storage device which is selected in said selecting unit, second access restriction information based on said first access restriction information of a port of said first storage device to which a volume, of which the port is utilized for an access, is assigned so that said first host computer is permitted to access said first storage device via the target port of said second storage device, while second host computer is not permitted to access said first storage device via the target port of said second storage device.

10. An access restriction information setting system having first and second storage devices which determine whether or not an access request to a volume is permitted in accordance with access restriction information which is set up on a port which receives the request, a plurality of host computers which transmit access requests to said first and second storage devices through a first network, and an access restriction information setting device which is connected to said first and second storage devices through a second network, wherein

said access restriction information setting device comprising:

an obtaining unit which obtains first access restriction information and information of a volume which are set up on each port of said first storage device, and attribute information including a port type and a status of utilization of each port of said second storage device, through a second network, said first access restriction information including information of access permission from a first host computer and access denial from a second host computer;

selecting unit which selects a target port of said second storage device which is utilized for reception of an access request to a volume of said first storage device from said host computer; and

setting unit which sets up, on the target port of said second storage device which is selected in said selecting unit, second access restriction information based on said first access restriction information of a port of said first storage device to which a volume, of which the port is utilized for an access, is assigned so that said first host computer is permitted to access said first storage device via the target port of said second storage device, while said second host computer is not permitted to access said first storage device via the target port of said second storage device.

11. A computer-readable program for setting access restriction information on a storage device, in a storage area network system having the storage device which determines whether or not an access request to a volume is permitted in accordance with access restriction information which is set up on a port which receives the request, and a plurality of host computers which transmit access requests to said storage device through a first network, wherein said program causes a computer to execute:

a first step for obtaining first access restriction information and information of a volume which are set up on each port of a first storage device, through a second network, said first access restriction information including information of access permission from a first host computer and access denial from a second host computer;

a second step for obtaining attribute information including a port type and a status of utilization of each port of a second storage device, from said second storage device through said second network;

a third step for selecting a target port of said second storage device which is utilized for reception of an access request to a volume of said first storage device from said host computer; and

a fourth step for setting up, on the target port of said second storage device which is selected in said third step, second access restriction information based on said first access restriction information of a port of said first storage device to which a volume, of which the port is utilized for an access, is assigned so that said first host computer is permitted to access said first storage device via the target port of said second storage device, while said second host computer is not permitted to access said first storage device via the target port of said second storage device.

12. An access restriction information setting method in which, in a storage area network system having a storage device which determines whether or not an access request to a volume is permitted in accordance with access restriction information which is set up on a port which receives the request, and a plurality of host computers which transmit access requests to said storage device through a first network, an access restriction information setting device which is connected to said storage device through a second network sets up access restriction information on said storage device, wherein

said access restriction information setting device:

obtains first access restriction information and information of a volume which are set up on each port of a first storage device, through said second network, said first access restriction information including information of access permission from a first host computer and access denial from a second host computer,

obtains attribute information including a port type and a status of utilization of each port of a second storage device, from said second storage device through said second network,

selects a target port of said second storage device which is utilized for reception of an access request to a volume of said first storage device from said host computer, and

sets up, on the target port of said second storage device which is selected in said selecting step, second access restriction information based on said first access restriction information of a port of said first storage device to which a volume, of which the port is utilized for an access, is assigned so that said first host computer is permitted to access said first storage device via the target port of said second storage device, while said second host computer is not permitted to access said first storage device via the target port of said second storage device.

13. An access restriction information setting apparatus which sets up access restriction information on a storage device, in a storage area network system having the storage device which determines whether or not an access request to a volume is permitted in accordance with access restriction information which is set up on a port which receives the request, and a plurality of host computers which transmit access requests to said storage device through a first network, comprising:

a network I/F unit which is utilized for connecting to said second network, and a calculation unit,

wherein, said calculation unit;

obtains first access restriction information and information of a volume which are set up on each port of a first storage device, from said first storage device and attribute information including a port type and a status of utilization of each port of a second storage device, from said second storage device, through said network I/F unit, said first access restriction information including information of access permission from a first host computer and access denial from a second host computer,

selects, as the port of the second storage, a target port which is utilized for receiving an access request from said host computer to a volume of said first storage device, and

sets up second access restriction information based on said first access restriction information of a port of said first storage device to which a volume, of which the port is utilized for an access, is assigned so that said first host computer is permitted to access said first storage device via the target port of said second storage device, while said second host computer is not permitted to access said first storage device via the target port of said second storage device.

16. An access restriction information setting apparatus according to claim 13, wherein

said calculation unit specifies the first access restriction information which is set up on each port of said first storage device and information of the volume, by obtaining a port of one of said host computers which is utilized for an access to the volume of said first storage device and information of the port of said first storage device, from said one host computer through said second network.

17. An access restriction information setting apparatus according to claim 13, wherein

said calculation unit

changes a port of said first storage device which is associated with each mount point of a file system of said host computer and a volume which is assigned to the port, to a port of said second storage device which is utilized for an access to the volume and a volume which is defined on the port.

18. An access restriction information setting apparatus according to claim 13, wherein

said first storage device sets up the first access restriction information on each port, by use of a first management table on which an information identifier of a volume and a source port of an access to be permitted are listed with a LUN unit with respect to each port, and

said second storage device sets up the second access restriction information on each port, by use of a second management table on which a LUN and an identifier of a volume are listed with a group unit of source ports of an access to be permitted with respect to each port, and

said calculation unit

obtains said first management table, and prepares said second management table as to each port of said second storage device which is selected as above, on the basis of a listed content of said first management table, and updates said second management table of said second storage device.

19. An access restriction information setting apparatus according to claim 13, wherein

in a case that said host computers have a plurality of paths which are used for an access to the same volume, a process of setting up said access restriction information to a volume is carried out at least twice separately to said plurality of paths.

14. An access restriction information setting system having first and second storage devices which determine whether or not an access request to a volume is permitted in accordance with access restriction information which is set up on a port which receives the request, a plurality of host computers which transmit access requests to said first and second storage devices through a first network, and an access restriction information setting device which is connected to said first and second storage devices through a second network, wherein

said access restriction information setting apparatus has a network I/F unit which is utilized for connecting to said second network, and a calculation unit, and

said calculation unit:

obtains first access restriction information and information of a volume which are set up on each port of said first storage device, and attribute information including a port type and a status of utilization of each port of said second storage device, from said second storage device, through said network I/F unit, said first access restriction information including information of access permission from a first host computer and access denial from a second host computer,

selects a target port of said second storage device which is utilized for reception of an access request to a volume of said first storage device from said host computer, and

sets up, on the target port of said second storage device which is selected in said selecting step, second access restriction information based on said first access restriction information of a port of said first storage device to which a volume, of which the port is utilized for an access, is assigned so that said first host computer is permitted to access said first storage device via the target port of said second storage device, while said second host computer is not permitted to access said first storage device via the target port of said second storage device.

15. An access restriction information setting system having first and second storage devices which determine whether or not an access request is permitted to a volume in accordance with access restriction information which is set up on a port which receives the request, a plurality of host computers which transmit access requests to said first and second storage devices, a Fibre Channel switch which configures a Fibre Channel network which connects between said first and second storage devices and said host computers, a management server which sets up access restriction information on said first and second storage devices, and a LAN which connects between said first and second storage devices and said management server, wherein

said first and second storage devices have a FC I/F which connects to said Fibre Channel switch, and

said management server

has a LAN I/F unit which is utilized for connecting to said LAN, and a calculation unit, and

said calculation unit:

obtains first access restriction information and information of a volume which are set up on each port of the FC I/F of said first storage device from said first storage device, and attribute information including a port type and a status of utilization of each port of the FC I/F of said second storage device, from said second storage device, through said LAN I/F unit, said first access restriction information including information of access permission from a first host computer and access denial from a second host computer,

selects a target port of said second storage device of a FC I/F of said second storage device which is utilized for an access to a volume of said first storage device, on the basis of attribute information of each port of the FC I/F of said second storage device, which is obtained as above, and

sets up, on the target port of the FC I/F of said second storage device which is selected in said selecting step, second access restriction information based on said first access restriction information of a port of said first storage device to which a volume, of which the port is utilized for an access, is assigned so that the first host computer is permitted to access said first storage device via said target port of said second storage device, while said second host computer is not permitted to access said first storage device via the target port of said second storage device.