Method and apparatus for enhanced computer security

• US 9,021,224 B2
• Filed: 06/30/2011
• Issued: 04/28/2015
• Est. Priority Date: 06/30/2011
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Tanaka, Daisuke, Tamura, Keishi
• Primary Examiner(s): Rossiter, Sean D
• Application Number:
  US13/146,627
• Publication Number:
  US 20130007395A1
• Time in Patent Office: 1,398 Days
• Field of Search: None
• US Class Current: 711/164
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0635 by changing the path, e.g. traffic rerouting, path reconfiguration
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A computer system and an access restriction method may be used to enable security and improve reliability. The computer system includes a first storage apparatus and a second storage apparatus. The first storage apparatus provides a first logical volume from/to which a host apparatus reads and writes data, and the second storage apparatus provides a virtual second logical volume obtained by virtualizing the first logical volume of the first storage apparatus to the host apparatus. The first path information relates to a path from the host apparatus to the second logical volume registered in the first storage apparatus in association with the first logical volume of the first storage apparatus. Reservation of and access to the first logical volume is granted only for a reservation request and access request with matching path information from the host apparatus.

Claims

1. A computer system, comprising:

a first storage apparatus which provides a first logical volume from/to which a host apparatus reads and writes data; and

a second storage apparatus that includes an external connection function which provides a second logical volume obtained by virtualizing the first logical volume of the first storage apparatus, to the host apparatus and provides a third logical volume, wherein the second storage apparatus is configured to copy data from the second logical volume to the third logical volume as receiving an access request to the second logical volume,

the first logical volume being reserved when the host apparatus accesses the first logical volume,

wherein the second storage apparatus;

receives a first registration-target key from the host apparatus, transmits, to the first storage apparatus, a first command containing the first registration-target key, and first path information, which relates to a path from the host apparatus to the second logical volume, in response to a key registration request from the host apparatus to the effect that a key is to be registered for the second logical volume,

receives a reservation request that includes a second key from the host apparatus,

transmits, to the first storage apparatus, a second command containing the second key, and second path information to reserve the second logical volume, which relates to a path from the host apparatus to the second logical volume, in response to the reservation request from the host apparatus to the effect that the second logical volume is to be reserved, and

transmits, from the second storage apparatus to the first storage apparatus, a third command containing third path information, which relates to a path from the host apparatus to the second logical volume, in response to an access request for access to the second logical volume from the host apparatus, and wherein the first storage apparatus;

upon receiving the first command, stores the first key and the first path information contained in the first command as reservation information in association with the first key registration-target logical volume,

upon receiving the second command, compares the first key and the first path information, which are contained in reservation information stored in association with the first logical volume which is a reservation target, with the second key and the second path information which are contained in the second command and, when there is a match between the first key and the first path information and the second key and the second path information, reserves the first logical volume for use by the host apparatus, and,

upon receiving the third command, compares the first path information, which is contained in the reservation information stored in association with the first logical volume which is an access target, with the third path information which is contained in the third command and, when there is a match between the first and third path information, access from the host apparatus is granted via the second storage apparatus,

wherein the second storage apparatus is configured to transmit a fourth command that corresponds to the reservation cancellation request to the first storage apparatus in response to a mapping cancellation request,

upon receiving the fourth command, the first storage apparatus is configured to transmit the corresponding reservation information stored for the corresponding first logical volume to the second logical volume,

wherein the second storage apparatus is configured to rewrite the reservation information transmitted by the first storage apparatus, and

wherein the second storage apparatus is configured to process the access restrictions using the rewritten reservation information.

2. The computer system according to claim 1,

wherein the second storage apparatus

transmits, to the first storage apparatus, a fourth command containing a third key, which is supplied by the host apparatus, and fourth path information, which relates to a path from the host apparatus to the second logical volume, in response to a reservation cancellation request from the host apparatus to the effect that reservation of the second logical volume is to be canceled, and

wherein the first storage apparatus,

upon receiving the fourth command, compares the first key and the first path information, which are contained in the reservation information stored in association with the first logical volume which is a reservation cancellation target, with the third key and the fourth path information which are contained in the fourth command and, when there is a match between the first key and the first path information, and the third key and the fourth path information, cancels the reservation of the first logical volume.

3. The computer system according to claim 1,

wherein the first and third path information contain at least:

an initiator number which is calculated on the basis of the address of the port of the host apparatus which is used when the host apparatus communicates with the second storage apparatus; and

a target number which is calculated on the basis of the address of the port of the second storage which is used when the second storage apparatus communicates with the host apparatus.

4. An access restriction method of a computer system which comprises a first storage apparatus which provides a first logical volume from/to which a host apparatus reads and writes data, and a second storage apparatus that includes an external connection function which provides a second logical volume obtained by virtualizing the first logical volume of the first storage apparatus, to the host apparatus and provides a third logical volume, wherein the second storage apparatus is configured to copy data from the second logical volume to the third logical volume as receiving an access request to the second logical volume, the first logical volume being reserved when the host apparatus accesses the first logical volume,

the access restriction method comprising:

receiving, by the second storage apparatus, a key registration request that includes a first registration-target key from the host apparatus,

transmitting, by the second storage apparatus to the first storage apparatus, in response to the key registration request from the host apparatus to the effect that a key is to be registered for the second logical volume, a first command containing the first registration-target key, and first path information, which relates to a path from the host apparatus to the second logical volume and, upon receiving the first command, the first storage apparatus stores the first key and the first path information contained in the first command as reservation information in association with the first key registration-target logical volume;

receiving a reservation request that includes a second key from the host apparatus;

transmitting, by the second storage apparatus to the first storage apparatus, in response to the reservation request from the host apparatus to the effect that the second logical volume is to be reserved, a second command containing a second key, which is supplied by the host apparatus, and second path information to reserve the second logical volume, which relates to a path from the host apparatus to the second logical volume and, upon receiving the second command, compares the first key and the first path information, which are contained in reservation information stored in association with the first logical volume which is a reservation target, with the second key and the second path information which are contained in the second command and, when there is a match between the first key and the first path information and the second key and the second path information, reserves the first logical volume for use by the host apparatus; and

transmitting, by the second storage apparatus to the first storage apparatus, in response to an access request for access to the second logical volume from the host apparatus, a third command containing third path information which relates to a path from the host apparatus to the second logical volume and, upon receiving the third command, the first storage apparatus compares the first path information, which is contained in the reservation information stored in association with the first logical volume which is an access target, with the third path information which is contained in the third command and, when there is a match between the first and third path information, granting access from the host apparatus via the second storage apparatus,

transmitting, by the second storage apparatus, a fourth command that corresponds to the reservation cancellation request to the first storage apparatus in response to a mapping cancellation request,

receiving, at the first storage apparatus, the fourth command,

transmitting, by the first storage apparatus, the corresponding reservation information stored for the corresponding first logical volume to the second logical volume,

rewriting, by the second storage apparatus, the reservation information transmitted by the first storage apparatus, and

processing, by the second storage apparatus, the access restrictions using the rewritten reservation information.

5. The access restriction method according to claim 4,

wherein, in response to a reservation cancellation request from the host apparatus to the effect that the reservation of the second logical volume is to be canceled, the second storage apparatus transmits, to the first storage apparatus, a fourth command containing a third key, which is supplied by the host apparatus, and fourth path information, which relates to a path from the host apparatus to the second logical volume, and

wherein the first storage apparatus,

upon receiving the fourth command, compares the first key and the first path information, which are contained in the reservation information stored in association with the first logical volume which is a reservation cancellation target, with the third key and the fourth path information which are contained in the fourth command and, when there is a match between the first key and the first path information, and the third key and the fourth path information, cancels the reservation of the first logical volume.

6. The access restriction method according to claim 4,

wherein the first and third path information contain at least:

an initiator number which is calculated on the basis of the address of the port of the host apparatus which is used when the host apparatus communicates with the second storage apparatus; and

a target number which is calculated on the basis of the address of the port of the second storage which is used when the second storage apparatus communicates with the host apparatus.