# US 11,308,243 B2 · Maintenance of access for security enablement in a storage device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,243 B2 - Document ID: US11308243B2 - Status: Granted - Kind: B2 - Application number: 16/568,160 - Filed: 2019-09-11 - Published: 2021-03-11 - Granted: 2022-04-19 - Earliest claimed: 2019-09-11 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Roger G. Hathorn; Patricia G. Driever; John Flanagan; Christopher J. Colonna; Evan Rivera - Web page: https://patentgrep.com/patent/US11308243B2 ## CPC - G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices - G06F 13/1668: {Details of memory controller} - G06F 21/44: Program or device authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A storage port receives a login request. The storage port configures an audit mode indicator as enabled in a login response to a host port to enter a security enabled mode to indicate to the host port that Input/Output (I/O) operations are to be transmitted from the host port to the storage port even if authentication or security association negotiation with the storage port cannot be completed successfully. ## Claims ### Claim 1 A method, comprising: receiving, by a storage port, a login request; and configuring, by the storage port, an audit mode indicator as enabled in a login response to a host port to enter a security enabled mode and indicate to the host port that Input/Output (I/O) operations are to be transmitted from the host port to the storage port even if authentication or security association negotiation with the storage port cannot be completed successfully. ### Claim 2 (depends on 1) The method of claim 1, wherein the login response in a first login response, the method further comprising: configuring, by the storage port, the audit mode indicator as not enabled in a second login response to the host port to enter a security enforced mode to indicate to the host port that I/O operations are not to be transmitted from the host port to the storage port if authentication or security association negotiation with the storage port cannot be completed successfully. ### Claim 3 (depends on 2) The method of claim 2, wherein the storage port is included in a storage controller, and wherein the storage controller includes a plurality of storage ports including the storage port, the method further comprising: configuring, by the storage controller, at least one storage port of the plurality of storage ports to the security enforced mode; and configuring, by the storage controller, at least one another storage port of the plurality of storage ports to the security enabled mode. ### Claim 4 (depends on 2) The method of claim 2, wherein the storage port is included in a storage controller that includes a first storage array and a second storage array, wherein the security enforced mode is configured for the first storage array, and wherein the security enabled mode is configured for the second storage array. ### Claim 5 (depends on 2) The method of claim 2, wherein a storage controller that includes the storage port maintain statistics on login counters and login characteristics including: a number of current logins to the storage port; a number of security capable logins counts to the storage port; and a number of security enabled login counts to the storage port. ### Claim 6 (depends on 5) The method of claim 5, wherein the statistics on login counters and login characteristics are used by the storage controller for determining an effect on I/O access by hosts if the security enforced mode is entered. ### Claim 7 (depends on 5) The method of claim 5, wherein the statistics on login counters and login characteristics are used by the storage controller to prevent a switchover to the security enforced mode from the security enabled mode if an I/O access is to be lost by a host on switchover to the security enforced mode. ### Claim 8 (depends on 5) The method of claim 5, wherein the storage controller provides an option to force switchover to the security enforced mode without consideration of the statistics on login counters and login characteristics. ### Claim 9 (depends on 1) The method of claim 1, wherein the audit mode indicator is enabled via an indication in auxiliary parameter data word 0, bit 23 in programs that implement Fibre Channel Link Services. ### Claim 10 A system, comprising: a memory; and a processor coupled to the memory, wherein the processor performs operations, the operations comprising: receiving, by a storage port, a login request; and configuring, by the storage port, an audit mode indicator as enabled in a login response to a host port to enter a security enabled mode and indicate to the host port that Input/Output (I/O) operations are to be transmitted from the host port to the storage port even if authentication or security association negotiation with the storage port cannot be completed successfully. ### Claim 11 (depends on 10) The system of claim 10, wherein the login response in a first login response, the operations further comprising: configuring, by the storage port, the audit mode indicator as not enabled in a second login response to the host port to enter a security enforced mode to indicate to the host port that I/O operations are not to be transmitted from the host port to the storage port if authentication or security association negotiation with the storage port cannot be completed successfully. ### Claim 12 (depends on 11) The system of claim 11, wherein the storage port is included in a storage controller, and wherein the storage controller includes a plurality of storage ports including the storage port, the operations further comprising: configuring, by the storage controller, at least one storage port of the plurality of storage ports to the security enforced mode; and configuring, by the storage controller, at least one another storage port of the plurality of storage ports to the security enabled mode. ### Claim 13 (depends on 11) The system of claim 11, wherein the storage port is included in a storage controller that includes a first storage array and a second storage array, wherein the security enforced mode is configured for the first storage array, and wherein the security enabled mode is configured for the second storage array. ### Claim 14 (depends on 11) The system of claim 11, wherein a storage controller that includes the storage port maintain statistics on login counters and login characteristics including: a number of current logins to the storage port; a number of security capable logins counts to the storage port; and a number of security enabled login counts to the storage port. ### Claim 15 (depends on 14) The system of claim 14, wherein the statistics on login counters and login characteristics are used by the storage controller for determining an effect on I/O access by hosts if the security enforced mode is entered. ### Claim 16 (depends on 14) The system of claim 14, wherein the statistics on login counters and login characteristics are used by the storage controller to prevent a switchover to the security enforced mode from the security enabled mode if an I/O access is to be lost by a host on switchover to the security enforced mode. ### Claim 17 (depends on 14) The system of claim 14, wherein the storage controller provides an option to force switchover to the security enforced mode without consideration of the statistics on login counters and login characteristics. ### Claim 18 A computer program product, the computer program product comprising a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code configured to perform operations, the operations comprising: receiving, by a storage port, a login request; and configuring, by the storage port, an audit mode indicator as enabled in a login response to a host port to enter a security enabled mode and indicate to the host port that Input/Output (I/O) operations are to be transmitted from the host port to the storage port even if authentication or security association negotiation with the storage port cannot be completed successfully. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein the login response in a first login response, the operations further comprising: configuring, by the storage port, the audit mode indicator as not enabled in a second login response to the host port to enter a security enforced mode to indicate to the host port that I/O operations are not to be transmitted from the host port to the storage port if authentication or security association negotiation with the storage port cannot be completed successfully. ### Claim 20 (depends on 19) The computer program product of claim 19, wherein the storage port is included in a storage controller, and wherein the storage controller includes a plurality of storage ports including the storage port, the operations further comprising: configuring, by the storage controller, at least one storage port of the plurality of storage ports to the security enforced mode; and configuring, by the storage controller, at least one another storage port of the plurality of storage ports to the security enabled mode. ### Claim 21 (depends on 19) The computer program product of claim 19, wherein the storage port is included in a storage controller that includes a first storage array and a second storage array, wherein the security enforced mode is configured for the first storage array, and wherein the security enabled mode is configured for the second storage array. ### Claim 22 (depends on 19) The computer program product of claim 19, a storage controller that includes the storage port maintain statistics on login counters and login characteristics including: a number of current logins to the storage port; a number of security capable logins counts to the storage port; and a number of security enabled login counts to the storage port. ### Claim 23 (depends on 22) The computer program product of claim 22, wherein the statistics on login counters and login characteristics are used by the storage controller for determining an effect on I/O access by hosts if the security enforced mode is entered. ### Claim 24 (depends on 22) The computer program product of claim 22, wherein the statistics on login counters and login characteristics are used by the storage controller to prevent a switchover to the security enforced mode from the security enabled mode if an I/O access is to be lost by a host on switchover to the security enforced mode. ### Claim 25 (depends on 22) The computer program product of claim 22, wherein the storage controller provides an option to force switchover to the security enforced mode without consideration of the statistics on login counters and login characteristics.