Storage management unit to configure zoning, LUN masking, access controls, or other storage area network parameters

• US 7,769,842 B2
• Filed: 08/08/2006
• Issued: 08/03/2010
• Est. Priority Date: 08/08/2006
• Status: Expired due to Fees

• Current Assignee: ENDL Texas, LLC
• Original Assignee: ENDL Texas, LLC
• Inventors: Weber, Ralph O.
• Primary Examiner(s): Strange; Aaron
• Assistant Examiner(s): Emdadi; Keyvan
• Application Number:
  US11/463,163
• Publication Number:
  US 20070033566A1
• Time in Patent Office: 1,456 Days
• Field of Search: 340/506, 707/204, 711/202, 716/19, 717/120
• US Class Current: 709/223
• CPC Class Codes: G06F 2003/0697 device management, e.g. handlers, drivers, I/O schedulers
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0634 by changing the state or mode of one or more devices
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Some of the embodiments disclosed are systems and methods of configuring an access masking structure which include, but are not limited to, selecting at least one computer to participate in an access restriction set, selecting at least one storage unit to participate in the access restriction set, disabling all non-selected computers, disabling all non-selected storage units and placing the access masking structure into learn mode. This method also comprises booting the computer, detecting activity between the selected computers and the selected storage units, and automatically building the access restriction set based upon the detected computers and storage units while the access masking structure is in the learn mode.

Claims

1. An access masking structure, comprising:

a mode selection mechanism selectable between a learn mode and an operational mode;

a processor operably connected to the mode selection mechanism;

computer code located on a non-transitory computer readable medium accessed by the processor responsive to selection of the learn mode by the mode selection mechanism to automatically configure an access restriction set based upon detected activity between enabled storage units and enabled computers on a network, wherein the access restriction set comprises the enabled storage units and enabled computers and does not comprise computers and storage units that are not enabled on the network during the learning mode; and

computer code located on a non-transitory computer readable medium accessed by the processor responsive to selection of the operational mode to enforce the access restriction set by blocking access between storage units and computers on the network that are not in the access restriction set.

2. The structure of claim 1, wherein the network carries traffic which includes SCSI commands and responses between computers and storage units.

3. The structure of claim 1, wherein the network technology and access masking structure used is selected from the group of:

Fibre Channel with Zoning, Fibre Channel with LUN Masking, Fibre Channel with SCSI Access Controls, SAS with Zoning, SAS with SCSI Access Controls, and TCP/IP with SCSI Access Controls.

4. The structure of claim 1, wherein the access masking structure further comprises an apparatus for disconnecting network or storage unit connections to the structure.

5. The structure of claim 1, wherein the mode selection mechanism may be is a switch, knob, or similar mechanical device located on the access masking structure.

6. The structure of claim 1, wherein the access masking structure further comprises computer code located on a non-transitory computer readable medium accessed by the processor to send and receive messages to a second access masking structure through the network.

7. The structure of claim 6, wherein the first access masking structure may place the second access masking structure into learn or run mode.

8. The structure of claim 1, wherein at least one element of the access masking structure comprises hardware on which at least a portion of the computer code runs, wherein the hardware is selected from the group consisting of:

a storage device, a router, a computer acting as a server, a plurality of computers acting as a server, a server and at least one of the enabled computers, a server and at least one of the enabled storage units, or a selection of the enabled computers or the selected storage units without an independent server.

9. A method of configuring an access masking structure to configure allowed access among a plurality of computers and a plurality of access storage units in a network comprising:

selecting at least one computer to participate in an access restriction set;

selecting at least one storage unit to participate in the access restriction set;

disabling all non-selected computers;

disabling all non-selected storage units;

placing the access masking structure into learn mode;

booting the selected computers;

detecting activity between the selected computers and the selected storage units; and

automatically building the access restriction set based upon the detected activity between the selected computers and the selected storage units while the access masking structure is in the learn mode, wherein the access restriction set comprises the selected computers and the selected storage units and does not comprise the disabled non-selected computers and the disabled non-selected storage units.

10. The method of claim 9, further comprising placing the access masking structure in run mode, enabling the selected computers to be permitted access to the selected storage units, and denying the selected computers to be permitted access to the non-selected storage units.

11. The method of claim 9, further comprising:

placing the access masking structure into the learn mode multiple times while different sets of non-selected computers or non-selected storage units are disabled;

booting at least one computer;

creating a plurality of access restriction sets; and

enforcing the plurality of access restriction sets.

12. The method of claim 9, wherein disabling non-selected computers comprises disabling all computers, disabling non-selected storage units comprises disabling all storage units, and after setting the access masking structure to learn mode enabling the selected storage units and then enabling the selecting computers and booting the selected computers.

13. The method of claim 9, wherein the disabling the storage units is preformed through at least one of the following:

physical removal, and power deactivation, or software disabling.

14. The method of claim 9, wherein the network technology and access masking structure used is selected from the group of:

Fibre Channel with Zoning, Fibre Channel with LUN Masking, Fibre Channel with SCSI Access Controls, SAS with Zoning, SAS with SCSI Access Controls, and transmission control protocol/internet protocol with SCSI Access Controls.

15. A method of configuring an access masking structure comprising;

connecting a first storage unit and a second storage unit to the access masking structure;

connecting a computer to the access masking structure;

disabling the second storage unit with respect to the access masking structure;

placing the access masking structure into a learn mode while the second storage unit is disabled;

bootstrapping the computer while the access masking structure is in the learn mode;

automatically programming the access masking structure to allow network communication between the computer and the first storage unit while the second storage unit is disabled and while the access masking structure is in the learn mode;

placing the access masking structure in a normal mode;

enabling the second storage unit while the access masking structure is in the normal mode;

allowing network access through the access masking structure the computer and the first network storage unit while the access masking structure is in the normal mode; and

blocking network access through the access masking structure between the computer and the second storage unit while the access masking structure is in the normal mode.

16. The method of claim 15, further comprising:

connecting a second computer to the access masking structure, blocking network access through the access masking structure between the second computer and the first storage unit, and blocking network access through the access masking structure between the second computer and the second storage unit.

17. The method of claim 15, wherein the access masking structure uses a networking technology selected from the group of:

fibre channel, serial attached SCSI, or local bus controller.

18. The method of claim 15, wherein the access masking structure permits or denies storage unit access based on the network addressing information associated with each storage unit and the logical unit number information associated with addressed logical units within each storage unit.

19. The method of claim 15, wherein the mechanism for placing the access masking structure in normal mode is a mechanical device.

20. The method of claim 15, wherein the mechanism for placing the access masking structure in learn mode causes one or more access masking structures on a network to operate in run or learn mode.