A method, system and apparatus for negotiating parameters for an IPSec connection between a requesting client and an iSCSI system using a computer system other than an iSCSI system are provided. By design, the iSCSI system monitors TCP (Transmission Control protocol) port 500 for secure requests. When a request enters port 500, the iSCSI system transmits all information received on port 500 to a computer system better suited to handle IPSec parameter negotiations. After the computer system has negotiated the parameters, the parameters are passed to the iSCSI system for a secure data transaction to ensue.
Drawings
Claims20
A method of transacting data over a secure network connection between an ISCSI system and a client system comprising the steps of:
receiving, from said client system, a request for a secure connection to transact the data;
forwarding said request to a host system, said host system being used for negotiating parameters of the secure connection with the client system;
and
passing the parameters of the secure connection to the iSCSI machine allowing the iSCSI machine and the client system to transact data over the secure connection.
1 more element
A computer program product on a computer readable medium for method of transacting data over a secure network connection between an iSCSI system and a client system comprising:
code means for receiving, from said client system, a request for a secure connection to transact the data;
code means for forwarding said request to a host system, said host system being used for negotiating parameters of the secure connection with the client system;
and
code means for passing the parameters of the secure connection to the iSCSI machine allowing the iSCSI machine and the client system to transact data over the secure connection.
1 more element
An apparatus for transacting data over a secure network connection between an iSCSI system and a client system comprising:
means for receiving, from said client system, a request for a secure connection to transact the data;
means for forwarding said request to a host system, said host system being used for negotiating parameters of the secure connection with the client system;
and
means for passing the parameters of the secure connection to the iSCSI machine allowing the iSCSI machine and the client system to transact data over the secure connection.
1 more element
A computer system for transacting data over a secure network connection between an iSCSI system and a client system comprising:
at least one storage system for storing code data;
and
at least one processor for processing the code data to receive, from said client system, a request for a secure connection to transact the data, to forward said request to a host system, said host system being used for negotiating parameters of the secure connection with the client system, and to pass the parameters of the secure connection to the iSCSI machine allowing the iSCSI machine and the client system to transact data over the secure connection.
#The present invention is directed to communications networks. More specifically, the present invention is directed to a method and apparatus for providing security to iSCSI data transaction.
#The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
#FIG. 1 is an exemplary block diagram illustrating a distributed data processing system according to the present invention.
#FIG. 2 is an exemplary block diagram of a server apparatus according to the present invention.
Detailed description2,335 words
#With reference now to the figures, FIG. 1 depicts a pictorial representation of a network of data processing systems in which the present invention may be implemented. Network data processing system 100 is a network of computers in which the present invention may be implemented. Network data processing system 100 contains a network 102, which is the medium used to provide communications links between various devices and computers connected together within network data processing system 100. Network 102 may include connections, such as wire, wireless communication links, or fiber optic cables.
#In the depicted example, server 104 is connected to network 102 along with storage unit 106. In addition, clients 108, 110, and 112 are connected to network 102. These clients 108, 110, and 112 may be, for example, personal computers or network computers. In the depicted example, server 104 provides data, such as boot files, operating system images, and applications to clients 108, 110 and 112. Clients 108, 110 and 112 are clients to server 104. Network data processing system 100 may include additional servers, clients, and other devices not shown. In the depicted example, network data processing system 100 is the Internet with network 102 representing a worldwide collection of networks and gateways that use the TCP/IP suite of protocols to communicate with one another. At the heart of the Internet is a backbone of high-speed data communication lines between major nodes or host computers, consisting of thousands of commercial, government, educational and other computer systems that route data and messages. Of course, network data processing system 100 also may be implemented as a number of different types of networks, such as for example, an intranet, a local area network (LAN), or a wide area network (WAN). FIG. 1 is intended as an example, and not as an architectural limitation for the present invention.
#Referring to FIG. 2, a block diagram of a data processing system that may be implemented as a server, such as server 104 in FIG. 1, is depicted in accordance with a preferred embodiment of the present invention. Data processing system 200 may be a symmetric multiprocessor (SMP) system including a plurality of processors 202 and 204 connected to system bus 206. Alternatively, a single processor system may be employed. Also connected to system bus 206 is memory controller/cache 208, which provides an interface to local memory 209. I/O bus bridge 210 is connected to system bus 206 and provides an interface to I/O bus 212. Memory controller/cache 208 and I/O bus bridge 210 may be integrated as depicted.