JP2002132588A - Storage control device and storage system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To achieve a variety of security management in an environment such that a storage control device receives access from a number of high order devices through a network. SOLUTION: In a storage system comprising the storage control device 40 being connected with a plurality of high order devices 10-30 through a fiber channel 70 and a subordinate disk array device 50, there is arranged an access control table 90 for setting an accessible time zone to a specific logical unit(LU) in the disk array device 50 of an individual high order device (N-Port-Name) in the storage control device 40. When a command of access requirement has been received from the high order devices 10-30, the storage control device 40 compares the time receiving the N-Port-Name and command accompanying the command with the setting contents of the access control table 90. When matched, (if the access time is within an accessible time zone), command processing is executed. When not matched, the processing is rejected.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a storage control technology and a storage system, and more particularly to a technology effective when applied to a storage system or the like connected to a plurality of higher-level devices via a network architecture interface.

[0002]

2. Description of the Related Art Conventionally, various techniques have been developed and used for preventing unauthorized access to a storage device in a computer system. One of them is disclosed in
JP-A-333839 discloses N_Port, which is information issued from a higher-level device connected via an interface such as a fiber channel and uniquely identifies a higher-level device.
N_ registered in advance using _Name information
A method is shown in which security is ensured by comparing with a Port_Name list, performing processing if they match, and rejecting the request if they do not match.

[0003]

In the above-mentioned prior art,
Although there is an advantage that unauthorized access can be prevented by appropriately restricting a higher-level device that can access the storage device, access according to a time zone in a case where the same storage area in the storage device is shared by a plurality of higher-level devices. No restrictions have been taken into account.

[0004] It is an object of the present invention not only to limit the relationship between the host device and the storage area, but also to restrict the access time zone to the storage area, thereby enabling various and reliable storage devices shared by a plurality of host devices. And security management.

It is another object of the present invention to accurately realize data backup of a storage device shared by a plurality of higher-level devices.

[0006]

SUMMARY OF THE INVENTION The present invention relates to a storage control device comprising a storage device under its control and connected to a plurality of higher-level devices via an interface to constitute a computer system. With the function of restricting access to the device using time information.

Further, according to the present invention, in a storage system including a storage control device connected to a plurality of higher-level devices via an interface and a storage device operating under the control of the storage control device, the storage control device includes A function of restricting access to the storage device from the device using time information.

More specifically, as an example, in the storage control device of the present invention, when accessing from a higher-level device, higher-level device identification information capable of uniquely identifying the higher-level device, the access time of the higher-level device, the storage control Compare the upper device identification information in the access control table preset for the device with the accessible time, and if the result of the comparison indicates that the access is possible, perform the processing of the access request command. If this is the case, information indicating that the command has been rejected is returned to the higher-level device, thereby realizing various and reliable security management functions for suppressing unauthorized access.

[0009]

Embodiments of the present invention will be described below in detail with reference to the drawings.

FIG. 1 is a conceptual diagram showing an example of a configuration of a computer system including a storage control device and a storage system according to an embodiment of the present invention. In FIG. 1, 1
Reference numerals 0, 20, and 30 are higher-level devices as central processing devices that perform data processing. Reference numeral 40 denotes a storage control device of the disk array device to which the present invention is applied. Storage controller 40
Are a higher-level device input / output controller 41 that performs input / output with an external higher-level device, a cache controller 42 that controls reading / writing of data from / to a cache, and a drive (disk device 50).
a cache 43 for temporarily storing read data from a) and write data to the drive, and a storage controller 4
It comprises a microprocessor 44 for controlling the entirety of 0, a timer 45 for measuring time information used for processing, and a drive input / output control unit 46 for inputting / outputting data to / from the drive (disk device 50a).

The disk device 50a has a redundant configuration of a plurality of units.
Is composed. The disk array device 50 is a storage device for storing data of the host devices 10 to 30,
The individual disk devices 50a are combined to provide redundancy. The storage area of the disk device 50a constituting the disk array device 50 can be logically divided.
AID level can be set. This split is RA
It is called an ID group. Then, the logically divided RAID group is further divided into logical units (Logica).
l Unit) (hereinafter referred to as LU), and each is managed by a number called Logical Unit Number (hereinafter referred to as LUN). The disk array device 50 shown in FIG.
(Logical unit 51) and L which is the first area of LUN
U1 (logical unit 52). Although only two LUs are set in FIG. 1, a maximum of 64 LUs can be set for each disk array device 50.

The plurality of higher-level devices 10, 20, 30 and the storage controller 40 are connected, for example, via a connection device called a fabric using a fiber channel 70 standardized by ANSIX3T11 as an interface. Further, the editing device 60 includes the storage control device 40.
Is used to refer to the information set in the disk array device 50 and to change the settings according to the information.

The operation of the computer system according to the present embodiment illustrated in FIG.
A case will be described as an example in which data transfer is performed with the disk array device 50 via the “0”. When the host device 10 issues, for example, a write command, in the storage control device 40, the microprocessor 44 responds to the request,
Command information from 0 and control information (access time and the like) necessary for security control described later in the present embodiment are stored in the cache 43. Then, a write completion report is sent to the host device 10. Thereafter, the microprocessor 44 controls the drive input / output control unit 46 to write data and redundant data to the disk array device 50. In this case, considering the operation in RAID5 which is a general RAID level, old data, old parity, new data and new parity are created. When a read command is issued from the host device 10, the data at the address for which the microprocessor 44 has requested access to the drive input / output control unit 46 is read from the disk array device 50 and stored in the cache 43. . After that, the data in the cache 43 is transferred to the higher-level device 10 via the higher-level device input / output controller 41, and then a read completion report is sent to the higher-level device 10.

Here, the host devices 10, 20, 30 in FIG.
A description will be given of the Fiber Channel 70 used to connect the storage controller 40 and the storage controller 40. A coaxial cable or an optical fiber communication medium is used to connect the fiber channel 70, and the maximum distance between the devices is 10 km for an optical fiber and 30 m for a coaxial cable. The maximum transfer rate is 133 Mbps in the case of a coaxial cable, and 1.0625 Gbps in the case of an optical fiber, so that the access can be made very fast.

In the case of the present embodiment, in the computer system illustrated in FIG.
Disk array device 5 including a plurality of higher-level devices 10 to 30
A function for restricting access to 0 is realized.

First, before the higher-level devices 10, 20, and 30 start up, a list of higher-level devices that can access the storage controller 40 is created as an access control table 90. The access control table 90 is stored in the storage controller 4
The content is stored in a storage medium that can be accessed by the microprocessor 44 of 0, and the editing device 60 sets and changes the content.

The list in the access control table 90 includes N_Port_Name information 91 which is information for uniquely identifying a higher-level device on the fiber channel 70, and input / output ports assigned to each higher-level device in the storage controller 40. , A logical unit number 93 of a logical unit (LU) in the disk array device 50 accessible to each host device, an accessible time zone 94 for each host device (access start time 94a, access end time 94b), etc. Set the information of.

At this time, the setting of the information is input from the editing device 60 using utility software. When the setting information of the above-described access control table 90 is changed using this utility software, it is necessary to input a password, thereby enhancing security. If the password is entered and the password matches the already set password, N_Port_Name information 91 and an accessible time zone 94 of a higher-level device accessible for each port (port address 92) of the storage controller 40 are entered. , And stores the input information in the access control table 90.

As an example, the host device 10 and the host device 20 can access the disk array device 50 from 10:00 to 15:00, the host device 30 cannot access the disk array device 50, and N_
The host device 10 sends the Port_Name information 91 to the HOST.
A, host device 20 is HOSTB, host device 30 is HOS
TC, the upper-level device input / output controller 4 of the storage controller 40
When the port 1 (port address 92) is CTL0P0, the access control table 90 is set as shown in FIG.

The access control table 90 shown in FIG.
By setting on a non-illustrated non-volatile memory in the storage controller 40, the control information can be protected even when an unexpected power interruption occurs. When the power is normally turned off, the information is stored in the disk device 50a. When the access control table 90 is updated, the information in the nonvolatile memory is stored in the disk device 50a.
By reflecting the above control information, the storage controller 4
0 can hold information semi-permanently.

Next, as a specific example of security management in the present embodiment, a data backup to which an access restriction function is applied will be described with reference to FIGS. 3, 4, 5, and 6.

First, out of the host device 10, host device 20, and host device 30, the host devices 10, 20 are assumed to be normally used hosts (servers), and the host device 30 is assumed to be a backup server used at the time of backup. The access control table 9 stored in the storage control device 40
0 is set as shown in FIG. Only the host device 10 can access LU0 of the disk array device 50, and access permission is given for all 24 hours. Access from the other higher-level devices 20 and 30 is not possible. Similarly, LU1 is only the host device 20 at 10:00.
Access is possible only between 15:00 and 15:00. For the LU 2 (logical unit 53), the host device 1
0 and can be accessed from the host device 30, but the host device 10 can access only from 10:00 to 15:00, and the host device 30 can access only from 22:00 to 07:00.

As an example, a case will be described in which an access request to the LU 2 is made to the storage control device 40 at 16:00 from the higher-level device 10. The storage controller 40 extracts N_Port_Name information from the received command, and stores the N_Port_Name information in the access control table 9 in the storage controller 40 that has already been set and held.
A comparison is made as to whether or not it is registered in the N_Port_Name list of 0. As a result, in this case, N_Port
_Name information matches, but time 16:00 is 10:
Since the access is not within the access permitted range of 00 to 15:00, the access request is rejected to the host device 10. Specifically, as an example, the LS on the fiber channel 70 is
An _RJT (Link Service Reject) frame is responded to the host device 10.

Next, an example of data backup processing in the above-described computer system will be described with reference to FIGS. 3, 5, and 6. FIG. In FIG. 3, the same data is written to two storage areas for LU0 and LU2 between 10:00 and 15:00, which is accessible by the host device 10. This indicates that a so-called double writing process is being performed.

FIG. 5 shows a state in which access from the higher-level device 10 to the LU 2 is rejected. this is,
Although the host device 10 is set in the N_Port_Name list of the storage control device 40, it is 10: 00 to 15: 00
This indicates that access to LU2 is denied by utilizing the fact that the value is not within the range of 0.

FIG. 6 shows that the data of the LU 2 is backed up to the tape device 80 during the time period from 22:00 to 07:00 by using the host device 30 (backup server). ing. In the setting example of the access control table 90 in FIG. 4, since only the upper device 30 can access the LU 2 during this time period, the data in the LU 2 is not changed during the backup.

When the above is arranged in a time series, first, in the process of FIG. 3, L is set in the time period of 10:00 to 15:00.
Data to be backed up is prepared by performing data double writing on U0 and LU2.

Then, the backup data LU2, which has been double-written in the process of FIG. 5, is separated so that the data is not updated any more (the combination of HOSTA and LU2 sets the accessible time period from 10:00 to 15:00. It is possible by setting it).

Finally, as shown in FIG.
During the time zone of 7:00, the separated storage area (logical unit LU2) in which the accessible time zone does not overlap with the HOSTA is backed up by the host device 30 (backup server).

In the case where access is restricted by setting an accessible time zone as in the present embodiment, for example, in a process such as data backup requiring a relatively long time, backup is performed within the accessible time zone. May not be completed. In that case, the target LU
The backup storage area is stored during the backup in the server, and if the access time is out of the accessible time zone during the processing, a backup incomplete error is reported to the higher-level device 30. Then, the higher-level device 30 that has received this report executes the data backup of the previously uncompleted storage area at the next data backup opportunity, for example. An example of such a data backup process is shown in the flowchart of FIG.

As described in the above embodiment, in a computer system including a plurality of higher-level devices 10 to 30, a storage controller 40, and a disk array device 50 thereunder, each of the plurality of higher-level devices 10 to 30 And a plurality of logical units (LU) in the disk array device 50
In addition to the access restriction based on the definition of the correspondence relationship with each of the above, the access restriction based on the setting of the accessible time zone for each of the plurality of logical units (LU) in the disk array device 50 of each of the plurality of higher-level devices 10 to 30 is combined. By doing so, unauthorized access from the host device can be suppressed by setting on the storage control device 40 side. Access can be prevented.

As a result, for example, a storage control device and a storage device which existed only under the control of a specific higher-order device in the past,
SAN (Storage Area Network)
As described above, even in the case of a computer system in which a storage control device and a storage device are directly connected to a number of higher-level devices on a large-scale network, access from an unauthorized host can be suppressed. Become.

Further, as described above, the setting of the accessible time zone for a specific LU is made different between the host devices 10 and 20 for normal data processing and the host device 30 for data backup. During the process of data backup from the LU 30, another higher-level device 1
Unauthorized access such as data update from 0 and 20 is also suppressed, and a plurality of higher-level devices share a storage device.
In a computer system such as an AN, reliable data backup can be performed.

Although the invention made by the present inventor has been specifically described based on the embodiments, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the gist of the invention. Needless to say, there is.

[0035]

According to the storage control device and the storage system of the present invention, not only the restriction based on the relationship between the host device and the storage area, but also the access time zone to the storage area is limited, so that the storage control device and the storage system can be used by a plurality of host devices. There is an effect that various security management of the shared storage device can be realized.

According to the storage control device and the storage system of the present invention, there is an effect that data backup of a storage device shared by a plurality of higher-level devices can be accurately realized.

[Brief description of the drawings]

FIG. 1 is a conceptual diagram illustrating an example of a configuration of a computer system including a storage control device and a storage system according to an embodiment of the present invention.

FIG. 2 is a conceptual diagram illustrating a setting example of control information used in a storage control device and a storage system according to an embodiment of the present invention.

FIG. 3 is a conceptual diagram illustrating an example of an operation of a storage control device and a storage system according to an embodiment of the present invention.

FIG. 4 is a conceptual diagram illustrating a setting example of control information used in a storage control device and a storage system according to an embodiment of the present invention.

FIG. 5 is a conceptual diagram showing an example of the operation of a storage control device and a storage system according to an embodiment of the present invention.

FIG. 6 is a conceptual diagram illustrating an example of an operation of a storage control device and a storage system according to an embodiment of the present invention.

FIG. 7 is a flowchart illustrating an example of an operation of a storage control device and a storage system according to an embodiment of the present invention.

[Explanation of symbols]

10 to 30: upper device, 40: storage controller, 41: upper device input / output controller, 42: cache controller, 43 ...
Cache, 44 microprocessor, 45 timer, 46 drive I / O controller, 50 disk array device, 50a disk device, 51, 52, 53 logical unit, 60 editing device, 70 fiber channel, 80 ... Tape device, 90 ... Access control table,
91: N_Port_Name information, 92: Port address, 93: Logical unit number, 94: Accessible time zone (time information), 94a: Access start time, 94b
… Access end time.

Claims (10)

[Claims] 1. A storage control device comprising a storage device under its control and being connected to a plurality of higher-level devices via an interface, thereby constituting a computer system, wherein a storage device between the higher-level device and the storage control device is provided. A storage control device having a function of restricting access using time information. 2. The storage control device according to claim 1, wherein
An access control table in which upper device identification information capable of uniquely identifying the upper device on the interface and access permission time zone information set for each of the upper devices are stored in association with each other; When requesting access to the storage device from
The higher-level device identification information of the higher-level device and the access time by the higher-level device are compared with the higher-level device identification information set in the access control table, and the access-permitted time zone information. If it is possible, process the access request,
If the access is not possible, the storage controller has a function of returning information indicating that the access request is rejected to the higher-level device. 3. The storage control device according to claim 2, wherein
The access control table, together with the higher-level device identification information and the access permitted time zone information on the interface, such as logical units, logical volumes, physical volumes, and the like set in the storage device managed by the storage control device A storage control device in which storage region identification information for identifying a storage region is stored in association with each other, and access by the higher-level device can be restricted for each of the storage regions. 4. The storage control device according to claim 2, wherein
The access control table is made editable by the specific higher-level device or editing device that can access the storage control device, and at the time of the editing, a protection measure such that unauthorized change is not performed. A storage control device, comprising: 5. The storage control device according to claim 1, wherein said interface is an ANIX3T1.
1. The higher-level device identification information is N_Po in the fiber channel.
A storage control device, which is rt_Name information. 6. A storage system comprising: a storage control device connected to a plurality of higher-level devices via an interface; and a storage device operating under the control of the storage control device. A storage system having a function of restricting access from a device to the storage device using time information. 7. The storage system according to claim 6, wherein
The storage control device is an access control table in which upper device identification information capable of uniquely identifying the upper device on the interface and access permission time zone information set for each of the upper devices are stored in association with each other. When the host device requests access to the storage device,
The higher-level device identification information of the higher-level device and the access time by the higher-level device are compared with the higher-level device identification information set in the access control table, and the access-permitted time zone information. If it is possible, process the access request,
If the access is not possible, the storage system has a function of returning information indicating that the access request is rejected to the host device. 8. The storage system according to claim 7, wherein
The access control table, together with the higher-level device identification information and the access permitted time zone information on the interface, such as logical units, logical volumes, physical volumes, and the like set in the storage device managed by the storage control device A storage system, wherein storage area identification information for identifying a storage area is stored in association with each other, and access by the higher-level device can be restricted for each of the storage areas. 9. The storage system according to claim 6, wherein the interface is an ANIX3T1.
1. A storage system, which is a fiber channel standardized in 1. 10. The storage system according to claim 6, wherein said storage device constitutes a disk array.