# US 8,543,701 B2 · Computer system and its control method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,543,701 B2
- Document ID: US8543701B2
- Status: Granted
- Kind: B2
- Application number: 13/132,716
- Filed: 2011-05-23
- Published: 2012-11-29
- Granted: 2013-09-24
- Earliest claimed: 2011-05-23
- Assignees: Hitachi, Ltd.
- Applicants: Keisuke Tominaga; Shuichi Yagi; Nobuyuki Osaki
- Inventors: Keisuke Tominaga; Shuichi Yagi; Nobuyuki Osaki
- Web page: https://patentgrep.com/patent/US8543701B2

## CPC

- G06F 3/0637: {Permissions}
- G06F 3/0622: {in relation to access}
- G06F 3/0631: {by allocating resources to storage systems}
- G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]}
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

It is an object of this invention to provide a computer system and its control method capable of preventing allocation of a resource(s), which is not intended by a superior administrator, to a certain storage administrator even when the superior administrator sets a certain authority to that storage administrator and intends to allocate a resource(s), which is required to enable this authority, to the storage administrator. When the superior administrator sets a certain authority to a certain storage administrator and intends to allocate a resource(s), which is required to enable this authority, to the storage administrator, the computer system prevents allocation of a resource(s), which is not intended by the superior administrator, to that storage administrator by optimizing allocation of resource groups and authorities to the storage administrator.

## Claims

### Claim 1

A computer system comprising:
a storage system for controlling read access or write access from a host computer to a storage device, wherein the storage system includes:
a plurality of resource groups respectively defined by grouping of a plurality of resources;
a storage area for storing management information of the plurality of resource groups and association information between the plurality of resources and the plurality of resource groups; and
a plurality of user groups, each user group having allocated to it a resource group and an authority which permits a user belonging to the user group to execute an operation on the resource group when the user is logged into the storage system; and
a management device for managing the plurality of resources for the storage system and a plurality of users sharing the storage system;
wherein, in response to receiving a request for allocating a first resource group to a user group, the management device is configured to:
use first information to determine whether the first resource group includes both a first resource which is necessary to execution of the authority allocated to the user group and a second resource which is not necessary to execution of the authority allocated to the user group, wherein the first information relates to a necessary resource type for execution of the authority allocated to the user group;
create, if it is determined that the first resource group includes both a first resource which is necessary to execution of the authority allocated to the user group and a second resource which is not necessary to execution of the authority allocated to the user group, a second resource group including the first resource without the second resource, and
represent the second resource group with the first resource group on a display of the management device.

### Claim 2 (depends on 1)

The computer system according to claim 1, wherein the storage system is partitioned into a plurality of virtual storage systems, wherein the plurality of user groups are assigned to at least one of the plurality of virtual storage systems, and wherein a plurality of resources allocated from the storage system to each virtual storage system is partitioned into a plurality of resource groups.

### Claim 3 (depends on 1)

The computer system according to claim 1, wherein the management device starts an optimization as triggered by a change of the authority which is allocated to at least one of the plurality of user groups.

### Claim 4 (depends on 1)

The computer system according to claim 1, wherein the management device executes, as an optimization, a change in a resource belonging to a resource group together with a change of the authority allocated to at least one of the plurality of user groups.

### Claim 5 (depends on 1)

The computer system according to claim 1, wherein the management device finds a shared resource group to be shared with another user group from among a plurality of resource groups allocated to a target user group; and executes an operation on the shared resource group.

### Claim 6 (depends on 1)

The computer system according to claim 1, wherein the management device finds a shared resource group to be shared with another user group from among a plurality of resource groups allocated to a target user group; extracts an authority that requires access to the shared resource group, from among authorities allocated to the target user group; and executes an operation on the shared resource group based on an authority selected from the extracted authority.

### Claim 7

A control method for a computer system, the computer system including a storage system for controlling read access or write access from a host computer to a storage device and a management device for managing a plurality of resources for the storage system and a plurality of users sharing the storage system, the computer system control method comprising the following steps executed by the management device of:
grouping the plurality of resources respectively to set a plurality of resource groups;
registering management information of the plurality of resource groups and association information between the plurality of resources and the plurality of resource groups, in the storage system;
defining a user group for the users and setting an authority to that user group which permits a user belonging to the user group to execute an operation on a resource group allocated to the user group when the user is logged into the storage system;
in response to receiving a request for allocating a first resource group of the plurality of resource groups to the first user group, using first information to determine whether the first resource group includes both a first resource which is necessary to execution of the authority allocated to the user group and a second resource which is not necessary to execution of the authority allocated to the user group, wherein the first information relates to a necessary resource type for execution of the authority allocated to the user group;
creating, if it is determined that the first resource group includes both a first resource which is necessary to execution of the authority allocated to the user group and a second resource which is not necessary to execution of the authority allocated to the user group, a second resource group including the first resource without the second resource, and
representing the second resource group with the first resource group on a display of the management device.