Authenticating a processing system accessing a resource

• US 8,230,435 B2
• Filed: 02/12/2008
• Issued: 07/24/2012
• Est. Priority Date: 02/12/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Brice, Frank William Jr., Chambliss, David Darden, Kalos, Matthew Joseph, Yudenfriend, Harry Morris
• Primary Examiner(s): Lee, Thomas
• Assistant Examiner(s): NGUYEN, PHIL K
• Application Number:
  US12/030,147
• Publication Number:
  US 20090204972A1
• Time in Patent Office: 1,624 Days
• Field of Search: 718/104, 718/1, 713/150, 713/155, 713/161, 713/180, 370/329, 370/400
• US Class Current: 718/104
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0683 Plurality of storage devices
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: G06F 9/5005 to service a request

Abstract

Provided are a method, system, and article of manufacture for authenticating a processing system accessing a resource. An association of processing system identifiers with resources, including a first and second resources, is maintained. A request from a requesting processing system in a host is received for use of a first resource that provides access to a second resource, wherein the request is generated by processing system software and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host. A determination is made as to whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources. The requesting processing system is provided access to the first resource that the processing system uses to access the second resource.

Claims

1. A method, comprising:

maintaining an association of processing system identifiers with resources, including a first and second resources;

receiving a request from a requesting processing system in a host for use of the first resource that provides access to the second resource, wherein the request is generated by processing system software and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host, wherein the received request is associated with a submitted path group identifier provided by the requesting processing system software;

maintaining an association of path group identifiers with resources, wherein the path group identifiers, identifying path groups, are associated with resources such that processing systems associated with one path group identifier are provided access to the resources associated with that path group identifier over paths included in the path group;

determining whether the path group identifier associated with the request matches the path group identifier associated with the first and second resources;

determining whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested first and second resources; and

providing the requesting processing system access to the first resource that the requesting processing system uses to access the second resource in response to determining that the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources.

3. The method of claim 1, further comprising:

for each path group identifier, indicating a processing system identifier identifying the processing system assigned to the path group identified by the path group identifier.

4. The method of claim 3, further comprising:

providing a control block for each path group identifier indicating the associated resources and processing system identifier associated with the path group identifier;

providing, to the processing system assigned to one path group, an index to an entry in a table for the path group identifier to which the processing system is assigned, wherein the processing system software includes a pointer in the submitted request for the resource to provide access to the entry in the table for the path group identifier included in the request.

2. A method, comprising:

maintaining an association of processing system identifiers with resources, including a first and second resources;

receiving a request from a requesting processing system in a host for use of the first resource that provides access to the second resource, wherein the request is generated by a processing system operating system and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host, wherein the processing system operating system cannot modify the submitted processing system identifier included by the host hardware;

determining whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources; and

providing the requesting processing system access to the first resource that the requesting processing system uses to access the second resource in response to determining that the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources.

5. A method, comprising:

maintaining path group identifiers, wherein each path group identifier identifies a path group, an association of the path group identifier, a base address of a volume and an alias address used to access the volume having the base address, and a processing system identifier of a processing system assigned to the path group identified by the path group identifier, wherein base and alias addresses are associated with path group identifiers such that the processing system associated with one path group identifier is provided access to the volume having the base address associated with that path group identifier;

receiving a request associated with a path group identifier from a requesting processing system in a host for use of the alias address that provides access to the volume having the base address, wherein the request is generated by processing system software and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host;

determining whether the path group identifier associated with the request matches the path group identifier associated with the base and alias addresses in the request,

determining whether the submitted processing system identifier matches the processing system identifier associated with the path group identifier in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested base and alias addresses; and

providing the requesting processing system access to the alias address that the requesting processing system uses to access the volume having the base address in response to determining that the submitted processing system identifier is one of the processing system identifiers associated with the base and alias addresses.

6. The method of claim 5, wherein the processing system identifier identifies a logical partition in the host from which the request originated, further comprising:

for each path group identifier, associating a host identifier of a host including the logical partition assigned to the path group identified by the path group identifier;

determining whether the base address and the alias address included in the request are associated with different hosts; and

determining whether the host identifier of the host including the logical partition submitting the request matches the host identifier associated with the path group identifier associated with the request in response to determining that the base and alias addresses in the submitted request are associated with different hosts, wherein the request to use the alias address to access the base address indicated in the request is granted in response to determining that the host identifier of the host matches the host identifier associated with the path group identifier associated with the request when the base and alias addressed indicated in the request are associated with different hosts.

7. The method of claim 6 wherein the host identifier is included in the submitted request by the host hardware.

8. A system in communication with processing systems in a host, wherein each processing system includes processing system software, comprising:

a computer readable medium including an association of processing system identifiers with resources, including a first and second resources;

an Input/Output (“

I/O”

) manager to perform operations, the operations comprising;

receiving a request from a requesting one of the processing systems in the host for use of the first resource that provides access to the second resource, wherein the request is generated by the processing system software in the requesting processing system and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host, wherein the received request is associated with a submitted path group identifier provided by the requesting processing system software;

maintaining an association of path group identifiers with resources, wherein the path group identifiers, identifying path groups, are associated with resources such that processing systems associated with one path group identifier are provided access to the resources associated with that path group identifier over paths included in the path group;

determining whether the path group identifier associated with the request matches the path group identifier associated with the first and second resources;

determining whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested first and second resources; and

providing the requesting processing system access to the first resource that the requesting processing system uses to access the second resource in response to determining that the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources.

10. The system of claim 8, wherein the I/O manager operations further comprise:

for each path group identifier, indicating a processing system identifier identifying the processing system assigned to the path group identified by the path group identifier.

9. A system in communication with processing systems in a host, wherein each processing system includes processing system software, comprising:

a computer readable medium including an association of processing system identifiers with resources, including a first and second resources;

an Input/Output (“

I/O”

) manager to perform operations, the operations comprising;

receiving a request from a requesting one of the processing systems in the host for use of the first resource that provides access to the second resource, wherein the request is generated by a processing system operating system in the requesting processing system and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host, wherein the processing system operating system cannot modify the submitted processing system identifier included by the host hardware;

determining whether the submitted processing system identifier is one of the requesting processing system identifiers associated with the first and second resources; and

providing the requesting processing system access to the first resource that the requesting processing system uses to access the second resource in response to determining that the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources.

11. A system in communication with processing systems in a host, wherein each processing system includes processing system software, comprising:

a computer readable medium including an association of processing system identifiers with resources, including a first and second resources;

an Input/Output (“

I/O”

) manager to perform operations, the operations comprising;

maintaining path group identifiers, wherein each path group identifier identifies a path group providing an association of the path group identifier, a base address of a volume and an alias address used to access the volume having the base address, and a processing system identifier of a processing system assigned to the path group identified by the path group identifier, wherein base and alias addresses are associated with path group identifiers such that the processing system associated with one path group identifier is provided access to the volume having the base address associated with that path group identifier;

receiving a request associated with a path group identifier from a requesting one of the processing systems in the host for use of the alias address that provides access to the volume having the base address, wherein the request is generated by the processing system software in the requesting processing system and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host;

determining whether the path group identifier associated with the request matches the path group identifier associated with the base and alias address in the request;

determining whether the submitted processing system identifier matches the processing system identifier associated with the path group identifier in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested base and alias addresses; and

providing the requesting processing system access to the alias address that the requesting processing system uses to access the volume having the base address in response to determining that the submitted processing system identifier is one of the processing system identifiers associated with the base and alias addresses.

12. The system of claim 11, wherein the processing system identifier identifies a logical partition in the host from which the request originated, wherein the I/O manager operations further comprise:

for each path group identifier, associating a host identifier of a host including the logical partition assigned to the path group identified by the path group identifier;

determining whether the base address and the alias address included in the request are associated with different hosts; and

determining whether the host identifier of the host including the logical partition submitting the request matches the host identifier associated with the path group identifier associated with the request in response to determining that the base and alias addresses in the submitted request are associated with different hosts, wherein the request to use the alias address to access the base address indicated in the request is granted in response to determining that the host identifier of the host matches the host identifier associated with the path group identifier associated with the request when the base and alias addressed indicated in the request are associated with different hosts.

13. An article of manufacture comprising a computer readable medium implementing an Input/Output (I/O) manager in communication with processing systems in a host, wherein each processing system includes processing system software, wherein the I/O manager is executed to cause operations, the operations comprising:

maintaining an association of processing system identifiers with resources, including a first and second resources;

receiving a request from a requesting one of the processing systems for use of the first resource that provides access to the second resource, wherein the request is generated by processing system software and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host, wherein the received request is associated with a submitted path group identifier provided by the requesting processing system software;

maintaining an association of path group identifiers with resources, wherein the path group identifiers, identifying path groups, are associated with resources such that processing systems associated with one path group identifier are provided access to the resources associated with that path group identifier over paths included in the path group;

determining whether the path group identifier associated with the request matches the path group identifier associated with the first and second resources;

determining whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested first and second resources; and

providing the requesting processing system access to the first resource that the requesting processing system uses to access the second resource in response to determining that the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources.

15. The article of manufacture of claim 13, wherein the operations further comprise:

for each path group identifier, indicating a processing system identifier identifying the processing system assigned to the path group identified by the path group identifier.

14. An article of manufacture comprising a computer readable medium implementing an Input/Output (I/O) manager in communication with processing systems in a host, wherein each processing system includes processing system software, wherein the I/O manager is executed to cause operations, the operations comprising:

maintaining an association of processing system identifiers with resources, including a first and second resources;

receiving a request from a requesting one of the processing systems for use of the first resource that provides access to the second resource, wherein the request is generated by a processing system operating system and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host, wherein the processing system operating system cannot modify the submitted processing system identifier included by the host hardware;

determining whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources; and

providing the requesting processing system access to the first resource that the requesting processing system uses to access the second resource in response to determining that the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources.

16. An article of manufacture comprising a computer readable medium implementing an Input/Output (I/O) manager in communication with processing systems in a host, wherein each processing system includes processing system software, wherein the I/O manager is executed to cause operations, the operations comprising:

maintaining path group identifiers, wherein each path group identifier identifies a path group providing, an association of the path group identifier, a base address of a volume and an alias address used to access the volume having the base address, and a processing system identifier of a processing system assigned to the path group identified by the path group identifier, wherein base and alias addresses are associated with path group identifiers such that the processing system associated with one path group identifier is provided access to the volume having the base address associated with that path group identifier;

receiving a request associated with a path group identifier from a requesting one of the processing systems for use of the alias address that provides access to the volume having the base address, wherein the request is generated by processing system software and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host;

determining whether the path group identifier associated with the request matches the path group identifier associated with the base and alias address in the request;

determining whether the submitted processing system identifier matches the processing system identifier associated with the path group identifier in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested base and alias addresses; and

providing the requesting processing system access to the alias address that the requesting processing system uses to access the volume having the base address in response to determining that the submitted processing system identifier is one of the processing system identifiers associated with the base and alias addresses.

17. The article of manufacture of claim 16, wherein the processing system identifier identifies a logical partition in the host from which the request originated, wherein the operations further comprise:

for each path group identifier, associating a host identifier of a host including the logical partition assigned to the path group identified by the path group identifier;

determining whether the base address and the alias address included in the request are associated with different hosts; and

determining whether the host identifier of the host including the logical partition submitting the request matches the host identifier associated with the path group identifier associated with the request in response to determining that the base and alias addresses in the submitted request are associated with different hosts, wherein the request to use the alias address to access the base address indicated in the request is granted in response to determining that the host identifier of the host matches the host identifier associated with the path group identifier associated with the request when the base and alias addressed indicated in the request are associated with different hosts.