Logical Unit Security for Clustered Storage Area Networks
AssigneeHitachi, Ltd.
InventorYuichi Taguchi
Life of this patent
Estimating the term…
Abstract
A system is described in which a plurality of host computers are coupled to a storage system for storing and retrieving data in the storage system. The storage system includes individually addressable units of storage such as volumes or logical unit numbers. A security management system controls access to each of the individually addressable units of storage based upon the identification of the host permitted to access that unit of storage.
Claims5
In a clustering system having primary and secondary host computers coupled to a plurality of storage systems and a management computer, wherein the primary and secondary host computers include cluster management functions, wherein each of the plurality of storage systems includes a LUN security function therein so that one or more predetermined host computers of the clustering system can access at least one of a plurality of logical units in the storage system, a method comprising:
- storing access control information in the storage system, in connection with host identification information and logical unit identification information, wherein the LUN security function in the storage system allows the primary host computer to access a specific logical unit of the logical units and disallows the secondary host computer to access the specific logical unit based on the access control information;
- changing ownership for the specific logical unit from the primary host computer to the secondary host computer by the cluster management functions;
- based upon ownership information provided by the cluster management functions, coordinating management of security for the specific logical unit in the management computer based on corresponding information to the access control information, the corresponding information to the access control information being stored in the management computer, in connection with storage identification information, the host identification information and the logical unit identification information;
- and
- changing the access control information in the storage system, for disallowing the primary host computer to access the specific logical unit and allowing the secondary host computer to access the specific logical unit based upon a request for changing the access control information from the management computer;
- wherein the request for changing the access control information from the management computer is issued if the secondary host computer takes over processing of the primary host computer.
In a clustering system having primary and secondary host computers coupled to a plurality of storage systems and a management computer, wherein the primary and secondary host computers include cluster management functions, wherein each of the plurality of storage systems includes a LUN security function therein so that one or more predetermined host computers of the clustering system can access at least one of a plurality of logical units in the storage system, a method comprising:
- storing access control information in the storage system, in connection with host identification information and logical unit identification information, wherein the LUN security function in the storage system allows the primary host computer to access a specific logical unit of the logical units and disallows the secondary computer to access the specific logical unit based on the access control information;
- and
- changing ownership for the specific logical unit from the primary host computer to the secondary host computer by the cluster management functions;
- based upon ownership information provided by the cluster management functions, coordinating management of security for the specific logical unit in the management computer based on corresponding information to the access control information, the corresponding information to the access control information being stored in the management computer, in connection with storage identification information, the host identification information and the logical unit identification information;
- and
- changing the access control information in the storage system, for disallowing the primary host computer to access the specific logical unit and allowing the secondary host computer to access the specific logical unit based upon a request for changing the access control information from the management computer;
- wherein the request for changing the access control information is coordinated by the management computer and is issued based upon a message sent when the secondary host computer takes over processing of the primary host computer.
Dependencies are inferred from the claim text.