Determining virtual adapter access controls in a computing environment

• US 9,374,324 B2
• Filed: 03/14/2014
• Issued: 06/21/2016
• Est. Priority Date: 03/14/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Sczepczenski, Richard M., Pandich, Johnathon R., Kuch, George P., Friedrich, Ralph, Higgs, Raymond M., Moore, Elizabeth A.
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): KHAN, HASSAN ABDUR-RAHMAN
• Application Number:
  US14/212,255
• Publication Number:
  US 20150263992A1
• Time in Patent Office: 830 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45545 Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 49/3054 Auto-negotiation, e.g. access control between switch gigabit interface connector [GBIC] and link
• CPC Class Codes: H04L 49/354 for supporting virtual local area networks [VLAN]
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A control component of a computing environment initiates sending of request(s) over a network of the computing environment by an activated virtual adapter. The activated virtual adapter is hosted on a physical adapter of a host system coupled to the network, and is for use by a guest, hosted by the host system, in performing data input and output. The request(s) retrieve access control information from the network indicative of access control(s) enforced in controlling access by the activated virtual adapter to network component(s). The initiating provides indication(s) to the physical adapter, absent involvement of the guest, that the request(s) be sent by the virtual adapter. Based on the initiating, the control component obtains the access control information from the physical adapter, and determines, based on that information, the access control(s) being enforced by the network in controlling access by the activated virtual adapter to the network component(s).

Claims

1. A computer program product, comprising:

a non-transitory computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising;

initiating, by a control component of a computing environment, sending of one or more requests over a network of the computing environment by an activated virtual adapter, the activated virtual adapter being hosted on a physical adapter of a host system coupled to the network, the activated virtual adapter for use by a guest, hosted by the host system, in performing data input and output, wherein the one or more requests retrieve access control information from the network, the access control information indicative of one or more access controls enforced by the network in controlling access by the activated virtual adapter to one or more network components of the network, and wherein the initiating comprises the control component providing one or more indications to the physical adapter, absent involvement of the guest, that the one or more requests be sent by the virtual adapter;

based on the initiating, obtaining, by the control component, the access control information from the physical adapter; and

determining, by the control component, based on the obtained access control information, the one or more access controls being enforced by the network in controlling access by the activated virtual adapter to the one or more network components, wherein the initiating initiates sending a first request, of the one or more requests, to determine remote ports of the network that are accessible to the activated virtual adapter, wherein the retrieved access control information comprises an indication of one or more remote ports of the network that are accessible to the activated virtual adapter, wherein the initiating initiates sending a second request, of the one or more requests, to log into a remote port of the indicated one or more remote ports accessible to the activated virtual adapter, and wherein the remote port is a remote port of storage device hosting a storage array, wherein a logical unit of the storage array is indicated by a logical unit number, and wherein a third request of the one or more requests comprises a logical unit number interrogation request.

2. The computer program product of claim 1, wherein the initiating and the obtaining by the activated virtual adapter is non-disruptive of use of the activated virtual adapter by the guest in performing data input and output, and wherein use of the activated virtual adapter in performing data input and output by the guest is non-disruptive of the initiating and the obtaining by the control component.

3. The computer program product of claim 1, wherein the initiating, obtaining, and determining occur prior to an initial program load of the guest.

4. The computer program product of claim 1, wherein the host system is a separate system from the control component, wherein the host system executes on a first set of one or more processors and the control component executes on a second set of one or more processors different from the first set of one or more processors.

5. The computer program product of claim 1, wherein the initiating initiates sending of a request, of the one or more requests, to log the activated virtual adapter into the network.

6. The computer program product of claim 1, wherein the one or more network components comprise a storage area network, and wherein the retrieved access control information comprises logical unit number masking data or zoning configuration data for controlling zones of the storage area network, wherein the determining determines one or more storage arrays to which the activated virtual adapter has access, or determines one or more zones of which the activated virtual adapter is a member.

7. The computer program product of claim 1, wherein the determined one or more access controls comprise an access control preventing access by the activated virtual adapter to a network component of the one or more network components.

8. The computer program product of claim 1, wherein the method further comprises:

determining, based on at least some of the obtained access control information, whether an access control of the determined one or more access controls is appropriate for controlling access by the activated virtual adapter to the one or more network components, wherein the determining is performed while the guest remains inactive; and

based on determining that the access control is not appropriate for controlling access by the activated virtual adapter to the one or more network components, reconfiguring the activated virtual adapter or a network component of the network prior to activating the guest.

12. The computer program product of claim 1, wherein the guest comprises a guest virtual machine hosted by the host system.

9. A system comprising:

a memory; and

a processor in communications with the memory, wherein the computer system is configured to perform a method, the method comprising;

initiating, by a control component of a computing environment, sending of one or more requests over a network of the computing environment by an activated virtual adapter, the activated virtual adapter being hosted on a physical adapter of a host system coupled to the network, the activated virtual adapter for use by a guest, hosted by the host system, in performing data input and output, wherein the one or more requests retrieve access control information from the network, the access control information indicative of one or more access controls enforced by the network in controlling access by the activated virtual adapter to one or more network components of the network, and wherein the initiating comprises the control component providing one or more indications to the physical adapter, absent involvement of the guest, that the one or more requests be sent by the virtual adapter;

based on the initiating, obtaining, by the control component, the access control information from the physical adapter; and

determining, by the control component, based on the obtained access control information, the one or more access controls being enforced by the network in controlling access by the activated virtual adapter to the one or more network components, wherein the initiating initiates sending a first request, of the one or more requests, to determine remote ports of the network that are accessible to the activated virtual adapter, wherein the retrieved access control information comprises an indication of one or more remote ports of the network that are accessible to the activated virtual adapter, wherein the initiating initiates sending a second request, of the one or more requests, to log into a remote port of the indicated one or more remote ports accessible to the activated virtual adapter, and wherein the remote port is a remote port of storage device hosting a storage array, wherein a logical unit of the storage array is indicated by a logical unit number, and wherein a third request of the one or more request comprises a logical unit number interrogation request.

10. The system of claim 9, wherein the one or more network components comprise a storage area network, and wherein the retrieved access control information comprises logical unit number masking data or zoning configuration data for controlling zones of the storage area network, wherein the determining determines one or more storage arrays to which the activated virtual adapter has access, or determines one or more zones of which the activated virtual adapter is a member.

11. The system of claim 9, wherein the system is further configured to perform:

determining, based on at least some of the obtained access control information, whether an access control of the determined one or more access controls is appropriate for controlling access by the activated virtual adapter to the one or more network components, wherein the determining is performed while the guest remains inactive; and

based on determining that the access control is not appropriate for controlling access by the activated virtual adapter to the one or more network components, reconfiguring the activated virtual adapter or a network component of the network prior to activating the guest.

13. The system of claim 9, wherein the guest comprises a guest virtual machine hosted by the host system.