Command processing system by a management agent

A storage subsystem comprising:

• a data storage area,
• an interface unit that receives management commands from a management computer, and
• a control unit that determines whether to permit the execution of the management commands against the data storage area, based on the security level of the communication path to and from the management computer and also on the security level required for the execution of such commands.

A management computer for managing a computer, a storage subsystem, and a connection control unit that controls the connection between the computer and the storage subsystem, each of these three being generically called a device, the management computer comprising:

• a control unit that issues commands for managing the device, and
• an interface unit that sends the commands to the device;
• the control unit being designed to determine whether or not to issue or send the commands to the device, based on the security level of the communication path to and from the device and also on the security level required for the execution of the commands.

A computer system comprising a computer, a storage subsystem, a connection control unit that controls the connection between the computer and the storage subsystem, and a management computer that manages the computer, the storage subsystem, and the connection control unit;

• the management computer comprising a control unit that issues commands for managing the computer, the storage subsystem, or the connection control unit, these three being generically called the device, and an interface unit that sends the commands to the device;
• and
• each of the devices comprising an interface unit that receives the commands from the. computer and a control unit that determines whether to execute them, based on the type of the communication path between the management computer and the device and also on the type of the commands.

A program providing a storage subsystem having a data storage area with:

• a capability to receive commands from a management computer, and
• a capability to determine whether to permit the execution of the commands against the data storage area, based on the security level of the communication path to and from the management computer and also on the security level required for the execution of the commands.

An access management method for managing access requests for a storage subsystem comprising the operations of:

• receiving commands from a management computer, and
• determining whether to permit the execution of the commands against a storage area of the storage subsystem, based on the security level of the communication path to and from the management computer and also on the security level required for the execution of the commands.