Fine granularity authorization control in FC-NVMe storage area network

An apparatus comprising:

• switch ports of a Fibre Channel (FC) switch configured to be connected an FC switch fabric through which servers connected to the FC switch fabric access logical partitions of a storage array connected to the FC switch fabric, wherein the servers and the storage array each include multiple respective ports;
• and
• a processor coupled to the switch ports and configured to perform:
• receiving, from the storage array, information indicative of port zoning rules, logical partition masking, and virtual machine mappings that collectively define which server ports are permitted access to which storage array ports and to which of the logical partitions of the storage array, and that defines virtual machine access to the logical partitions, the switch ports, and the server ports:
• generating, from the information, authorization rules for enforcing the port zoning rules and, the logical partition masking, and the virtual machine mappings, and programming the authorization rules into memory;
• receiving at the switch ports FC frames from the server ports, the FC frames conveying respective input-output (IO) operations destined for the logical partitions;
• and authorizing each IO operation based on a lookup of the programmed authorization rules to enforce the port zoning rules, the logical partition masking, and the virtual machine mappings on the IO operation at the FC switch.

A non-transitory computer readable medium encoded with instructions that, when executed by a processor of a Fibre Channel (FC) switch of an FC switch fabric through which servers connected to the FC switch fabric access logical partitions of a storage array connected to the FC switch fabric, wherein the FC switch, the servers, and the storage array each include multiple ports, cause the processor to perform:

• receiving, from the storage array, information indicative of port zoning rules, logical partition masking, and virtual machine mappings that collectively define which server ports are permitted access to which storage array ports and to which of the logical partitions of the storage array, and that defines virtual machine access to the logical partitions, switch ports, and the server ports:
• generating, from the information, authorization rules for enforcing the port zoning rules, the logical partition masking, and the virtual machine mappings, and programming the authorization rules into memory;
• receiving at the switch ports FC frames from the server ports, the FC frames conveying respective input-output (IO) operations destined for the logical partitions;
• and
• authorizing each IO operation based on a lookup of the programmed authorization rules to enforce the port zoning rules, the logical partition masking, and the virtual machine mappings on the IO operation at the switch.