Security method and system for storage subsystem

• US 7,606,806 B2
• Filed: 01/12/2006
• Issued: 10/20/2009
• Est. Priority Date: 01/14/2000
• Status: Expired due to Fees

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Okami, Yoshinori, Ito, Ryusuke
• Primary Examiner(s): Ali; Mohammad
• Assistant Examiner(s): Hocker; John P
• Application Number:
  US11/330,261
• Publication Number:
  US 20060161548A1
• Time in Patent Office: 1,377 Days
• Field of Search: 711/15, 707 1- 10
• US Class Current: 1/1
• CPC Class Codes: G06F 2003/0697 device management, e.g. handlers, drivers, I/O schedulers
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0635 by changing the path, e.g. traffic rerouting, path reconfiguration
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: Y10S 707/954 Relational
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

According to the present invention, techniques for performing security functions in computer storage subsystems in order to prevent illegal access by the host computers according to logical unit (LU) identity are provided. In representative embodiments management tables can be used to disclose the Logical Unit in the storage subsystem to the host computers in accordance with the users operational needs. In a specific embodiment, accessibility to a storage subsystem resource can be decided when an Inquiry Command is received, providing systems and apparatus wherein there is no further need to repeatedly determine accessibility for subsequent accesses to the Logical Unit. Many such embodiments can maintain relatively high performance, while providing robust security for each LU.

Claims

1. A storage system, comprising:

a processor, in response to receiving a first frame including an Inquiry Command, which is used to inquire about the status of a logical unit (LU), and being received from at least one computer of a plurality of computers according to a fibre channel protocol, being adapted to send a second frame including Inquiry Data to the at least one computer of the plurality of computers according to said fibre channel protocol;

wherein, if the first frame is received from a first computer and includes a first virtual logical unit number (LUN), which corresponds to a first LUN identifying a first LU which is accessible by the first computer, the storage system is adapted to send the second frame including first Inquiry Data, wherein the first virtual LUN is 0, and the first Inquiry Data indicates that the first LU, related to the first virtual LUN, is installed in the storage system,

wherein, if the first frame is received from a second computer of the plurality of computers, other than the first computer, and includes a second virtual LUN, which does not relate to any LU that is accessible by the second computer, the storage system is adapted to send the second frame including second Inquiry Data, the second Inquiry Data indicating that the second LU, related to the second virtual LUN, is not installed in the storage system,

wherein, if the first frame is received from a third computer, other than the first and second computers, and includes a third virtual LUN, which corresponds to a third LUN, different from the first LUN, identifying a third LU which is accessible by the third computer, the storage system is adapted to send the second frame including third Inquiry Data, wherein the third virtual LUN is 0, and the third Inquiry Data indicates that the third LU, related to the third virtual LUN, is installed in the storage system.

2. A storage system according to claim 1, wherein:

the first frame includes an S_ID of the first computer, the second computer or the third computer of the plurality of computers;

the first information relates the first virtual LUN to a first S_ID of the first computer.

3. A storage system according to claim 2, wherein:

the storage system is adapted to use the S_ID included in the first frame for obtaining a WWN, corresponding to the S_ID included in the first frame; and

the storage system is adapted to use the obtained WWN and the first virtual LUN included in the first frame for creating the first Inquiry Data or the second Inquiry Data.

4. A storage system according to claim 1, wherein:

the first Inquiry Data identifies that the first LU related to the first virtual LUN included in the first frame is accessible by an I/O command, and

the second Inquiry Data identifies that the first LU related to the first virtual LUN included in the first frame is not accessible by an I/O command.

5. A storage system according to claim 1, wherein:

the storage system is adapted to continue to receive I/O requests to the first virtual LUN after sending the second frame including the first Inquiry Data.

6. A storage system according to claim 1, wherein:

the storage system is adapted to continue to receive I/O requests to the first virtual LUN without checking the accessibility of the first LU after sending the second frame including the first Inquiry Data.

7. A storage system according to claim 1, wherein:

the Inquiry Command is supported in a SCSI command set.

8. A storage system according to claim 1, wherein:

the first identifier addresses a port of the first computer.

9. A storage system according to claim 1, wherein:

the processor is adapted to send the second frame including the first Inquiry Data.

10. A storage system, comprising:

a processor controlling to receive a first frame including an Inquiry Command, which is used to inquire about the status of a logical unit (LU), and received from a port of one of a plurality of computers according to a fibre channel protocol, the first frame including a virtual logical unit number (LUN) for a LUN identifying the logical unit, and,

in response to receiving the first frame, the processor controlling to send a second frame including an Inquiry Data to the port of the one of the plurality of computers,

wherein the Inquiry Data for the second frame includes a code of Qualifier, and wherein the code of Qualifier differs based on whether or not the port of the one of the plurality of computers is permitted to access the LU related to the virtual LUN, and

wherein a first virtual LUN, for a first LUN identifying a first LU that is permitted to be accessed by a first port of one of the plurality of computers, is 0, and wherein a second virtual LUN, for a second LUN that is different from the first LUN and identifies a second LU which is permitted to be accessed by a second port of one of the plurality of computers, is also 0.

11. A storage system according to claim 10, further comprising:

a memory being adapted to store a first information, indicating whether or not the port of the one of the plurality of computers is permitted to access the LU related to the virtual LUN, before receiving the first frame.

12. A storage system according to claim 10, wherein:

the processor controls to send, if the port of the one of the plurality of computers is permitted to access the LU related to the virtual LUN, the code of Qualifier in the Inquiry Data identifying that the LU related to the virtual LUN is installed in the storage system, and

the processor controls to send, if the port of the one of the plurality of computers is not permitted to access the LU related to the virtual LUN, the code of Qualifier in the Inquiry Data identifying that the LU related to the virtual LUN is not installed in the storage system.

13. A storage system according to claim 12, wherein:

the first frame includes an S_ID of the port of the one of the plurality of computers.

14. A storage system according to claim 13, wherein:

the processor controls to use the S_ID included in the first frame for obtaining a WWN corresponding to the S_ID included in the first frame; and

the processor controls to use the obtained WWN and the virtual LUN included in the first frame for creating the code of Qualifier in the Inquiry Data.

15. A storage system according to claim 10, wherein:

the processor controls to send, if the port of the one of the plurality of computers is permitted to access the LU related to the virtual LUN, the code of Qualifier in the Inquiry Data identifying that the virtual LUN included in the first frame is accessible by an I/O command.

16. A storage system according to claim 15, wherein:

the processor controls to send, if the port of the one of the plurality of computers is not permitted to access the LU related to the virtual LUN, the code of Qualifier in the Inquiry Data identifying that the virtual LUN included in the first frame is not accessible by an I/O command.

17. A storage system according to claim 10, wherein:

the processor controls to continue to receive I/O requests to the virtual LUN after sending the second frame including the Inquiry Data, if the code of Qualifier in the Inquiry Data identifies that the virtual LUN included in the first frame is accessible by I/O requests.

18. A storage system according to claim 10, wherein:

the processor controls to continue to receive I/O requests to the LUN without checking the accessibility of the LU related to the virtual LUN after sending the second frame including the Inquiry Data, if the code of Qualifier in the Inquiry Data identifies that the LU related to the virtual LUN is installed in the storage system.

19. A storage system according to claim 10, wherein:

the Inquiry Command is supported in a SCSI command set.

29. A method of controlling a storage system according to claim 10, wherein:

the Inquiry Command is supported in a SCSI command set.

20. A method of controlling a storage system, comprising:

a step for receiving a first frame including an Inquiry Command, which is used to inquire about the status of a logical unit (LU), from a port of one of a plurality of computers according to a fibre channel protocol, the first frame including a logical unit number (LUN) corresponding to a logical unit identifier, the logical unit identifier identifying the LU in the storage system;

a step for sending a second frame including an Inquiry Data to the port according to said fibre channel protocol in response to the first frame;

wherein a code of Qualifier in the Inquiry Data for the second frame differs based on whether or not the port of the one of the plurality of computers is permitted to access the LU related to the LUN, and

wherein a first LUN, corresponding to a first logical unit identifier identifying a first LU that is permitted to be accessed by a first port of one of the plurality of computers, is 0, and wherein a second LUN, different from the first LUN and corresponding to a second logical unit identifier identifying a second LU that is permitted to be accessed by a second port of one of the plurality of computers, is also 0.

21. A method of controlling a storage system according to claim 20, further comprising:

a step for storing a first information, indicating whether or not the port of the one of the plurality of computers is permitted to access the LU related the LUN, before receiving the first frame.

22. A method of controlling a storage system according to claim 20, wherein:

if the port of the one of the plurality of computers is permitted to access the LU related to the LUN, the code of Qualifier in the Inquiry Data identifies that the LU related to the LUN included in the first frame is installed in the storage system, and

if the port of the one of the plurality of computers is not permitted to access the LU related to the LUN, the code of Qualifier in the Inquiry Data identifies that the LU related to the LUN included in the first frame is not installed in the storage system.

23. A method of controlling a storage system according to claim 22:

wherein the first frame includes an S_ID of the port of the one of the plurality of computers.

24. A method of controlling a storage system according to claim 23, further comprising:

a step for using the S_ID included in the first frame,

a step for obtaining a WWN corresponding to the S_ID included in the first frame; and

a step for using the obtained WWN and the LUN included in the first frame for preparing the code of Qualifier in the Inquiry Data.

25. A method of controlling a storage system according to claim 20, wherein:

if the port of the one of the plurality of computers is permitted to access the LU related to the LUN, the code of the Qualifier in the Inquiry Data identifies that the LUN included in the first frame is accessible.

26. A method of controlling a storage system according to claim 25, wherein:

if the port of the one of the plurality of computers is not permitted to access the LU related to the LUN, the code of the Qualifier in the Inquiry Data identifies that the LUN included in the first frame is not accessible by an I/O command.

27. A method of controlling a storage system according to claim 20, further comprising:

a step for continuing to receive I/O requests to the LUN after sending the second frame including the Inquiry Data, if the code of the Qualifier in the Inquiry Data identifies that the LUN included in the first frame is accessible by I/O requests.

28. A method of controlling a storage system according to claim 20, further comprising:

a step for continuing to receive I/O requests to the LUN without checking the accessibility of the LU related to the LUN after sending the second frame including the Inquiry Data, if the code of the Qualifier in the Inquiry Data identifies that the LU related to the LUN is installed in the storage system.

30. A data object to be stored in a memory unit within a storage system, the data object comprising:

a code for receiving a first frame related to an Inquiry Command, which is used to inquire about the status of a logical unit (LU), from a port of one of a plurality of computers according to a fibre channel protocol, the first frame including a logical unit number (LUN), which corresponds to a logical unit identifier identifying the LU; and

a code for sending a second frame related to an Inquiry Data to the port according to said fibre channel protocol in response to the first frame;

wherein a Qualifier information in the Inquiry Data for the second frame differs based on whether or not the port is permitted to access the logical unit related to the LUN, and

wherein a first LUN, corresponding to a first logical unit identifier identifying a first LU that is permitted to be accessed by a first port of one of the plurality of computers, is 0, and wherein a second LUN, different from the first LUN and corresponding to a second logical unit identifier identifying a second LU that is permitted to be accessed by a second port of one of the plurality of computers, is also 0.

31. A data object to be stored in a memory unit within a storage system according to claim 30, further comprising:

a code for storing a first information linking an LUN, a logical unit identifier and a World Wide Name (WWN) of a port of one of the plurality of computers before receiving the first frame, the first information being used for preparing the Inquiry Data for the second frame.

32. A data object to be stored in a memory unit within a storage system according to claim 30:

the data object further comprising;

a code for sending, if the first frame is received from the first port, the second frame including a first Inquiry Data, the first Inquiry Data identifying that the first logical unit related to the first LUN included in the first frame is installed in the storage system,

a code for sending, if the first frame is received from the second port, the second frame including a second Inquiry Data, the second Inquiry Data identifying that the second logical unit related to the second LUN included in the first frame is installed in the storage system, and

a code for sending, if the first frame is received from a third port of one of the plurality of computers which is not permitted to access the first logical unit related to the first LUN, the second frame including a third Inquiry Data, the third Inquiry Data identifying that the first logical unit related to the first LUN included in the first frame is not installed in the storage system.

33. A data object to be stored in a memory unit within a storage system according to claim 31:

wherein the first frame includes an S_ID of the port of one of the plurality of computers;

the data object further comprising;

a code for storing a second information linking a first S_ID of the first port and the first WWN;

a code for sending, if the first frame is received from the first port, the second frame including the first Inquiry Data based on the first information and the second information.

34. A data object to be stored in a memory unit within a storage system according to claim 33, the data object further comprising:

a code for searching the second information using the S_ID included in the first frame,

a code for obtaining a WWN corresponding to the S_ID included in the first frame based on the second information; and

a code for searching the first information using the obtained WWN and the first LUN included in the first frame.

35. A data object to be stored in a memory unit within a storage system according to claim 34, further comprising:

a code for making a judgment whether or not a LUN, corresponding to the obtained WWN and being in the first information, is the LUN included in the first frame in order to send the second frame.

36. A data object to be stored in a memory unit within a storage system according to claim 30:

the data object further comprising;

a code for sending, if the first frame is received from the first port, the second frame including a first Inquiry Data, the first Inquiry Data identifying that the first logical unit related to the first LUN included in the first frame is accessible, and

a code for sending, if the first frame is received from the second port, the second frame including a second Inquiry Data, the second Inquiry Data identifying that the second logical unit related to the second LUN included in the first frame is accessible.

37. A data object to be stored in a memory unit within a storage system according to claim 36, further comprising:

a code for sending, if the first frame is received from a third port of one of the plurality of computers which is not permitted to access the first logical unit related to the first LUN, the second frame including a second Inquiry Data, the second Inquiry Data identifying that the first logical unit related to the first LUN included in the first frame is not accessible.

38. A data object to be stored in a memory unit within a storage system according to claim 30, further comprising:

a code for continuing to receive I/O requests to the first LUN after sending the second frame including a first Inquiry Data, the first Inquiry Data identifying that the first logical unit related to the first LUN included in the first frame is accessible.

39. A data object to be stored in a memory unit within a storage system according to claim 30, further comprising:

a code for continuing to receive I/O requests to the first LUN without checking the accessibility of the first logical unit after sending the second frame including a first Inquiry Data, the first Inquiry Data identifying that the first logical unit related to the first LUN included in the first frame is accessible.

40. A data object to be stored in a memory unit within a storage system according to claim 30, wherein:

the Inquiry Command is supported in a SCSI command set.