JP3972596B2 - Disk array system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention mainly relates to a control system for a disk array system used as a storage system of a computer system, and more particularly to access security of the disk array system.
[0002]
[Prior art]
The disk array system, also called RAID (Redundant Arrays of Inexpensive Disks), has a configuration in which a plurality of disk devices are arranged in an array, and read requests (data read requests) and write requests (data write requests) from the host. ) Is processed at high speed by the parallel operation of the disks, and the reliability is improved by adding redundant data to the data. Disk array systems are classified into five levels according to the type and configuration of redundant data (Paper: "A Case for Redundant Arrays of Inexpensive Disks (RAID)", David A. Patterson, Garsh Gibson, and Randy H. Katz. , Computer Science Division Department of Electrical Engineering and Computer Sciences, University of California Berkeley ACM SIGMOD pp. 109-116 1988).
[0003]
The disk array system has a disk group composed of a plurality of disks. In order to realize the disk array as described above, a read / write request from the host is converted into a read / write request to each disk, data is distributed to each disk at the time of writing, and data is read from each disk at the time of reading. It is necessary to perform data distribution / aggregation control. Such control is called disk array control.
[0004]
A read / write request from a host is generally made in units of logical units called LUs (Logical Units).
[0005]
As an interface for connecting a host and a disk array, a dedicated interface has been used for connection to a mainframe, and a small computer system interface (SCSI) or a fiber channel has been used for connection to an open system. However, in recent years, there has been an increasing demand for connecting storage via a network using IP (Internet Protocol) as a protocol, which has exploded in popularity over the Internet, and there is a standard called iSCSI (Internet SCSI) that carries a SCSI protocol on IP. Draft-satran-iscsi-01.txt has been published as Internet-Draft as of June 2000 as studied by the IETF (Internet Engineering Task Force).
[0006]
When storage devices can be directly connected to an IP network by IP storage technology using iSCSI as an example, accessibility to storage devices including a disk array system is dramatically improved.
[0007]
[Problems to be solved by the invention]
If the disk array system is directly connected to the IP network by the iSCSI technology and the disk array system can be easily accessed from a computer on the IP network, the chance of unauthorized access increases accordingly, and a security function to prevent unauthorized access is provided. It becomes important.
[0008]
When the host and the disk array system are connected via a dedicated storage network called SAN (Storage Area Network), which is composed of Fiber Channel, access from a host other than the host that is set in advance to a certain LU is regarded as unauthorized access. The security in data transfer has been enhanced by using a LUN security function that is not accepted. The LUN security function is disclosed in Japanese Patent Laid-Open No. 10-333839.
[0009]
However, if the SCSI protocol is encapsulated in the IP by the iSCSI technology, it is not possible to simply identify the LU simply by looking at the IP packet flowing on the network. In order to specify the access destination LU and the access source host, it is necessary to analyze the iSCSI packet further in the TCP packet in the IP packet, and the disk array system is connected to the IP network by iSCSI. In this case, there is a problem that it is difficult to realize a LUN security function similar to the conventional one.
[0010]
In the IP network, various security functions are implemented in routers interconnecting the networks. However, these functions are based on IP and cannot be used for security of the disk array system as they are.
[0011]
An object of the present invention is to realize a security function equivalent to conventional LUN security using an IP address in a disk array connected to an IP network by iSCSI technology.
[0012]
Still another object of the present invention is to realize security equivalent to LUN security in a router without modifying the conventional router.
[0013]
[Means for Solving the Problems]
To achieve the above object, the present invention relates to an array type disk system having a plurality of disk devices arranged on an array, a network interface connected to an IP network for solving the iSCSI protocol, and a disk array for performing disk array control. In addition to the controller, means for holding a plurality of IP addresses in one network interface, means for managing IP addresses and LUs in the disk array in association with each other, transfer source and transfer destination based on preset settings Means is provided for determining whether the transfer is an illegal transfer based on the set of IP addresses and filtering.
[0014]
In addition to the disk array management function, a management terminal that has previously managed an array type disk system has a function of mapping and mapping a plurality of IP addresses and LUs held by the disk array and notifying the disk array of the result. A function is provided for associating which host can access which LU, managing it at the IP address level, and setting a set of accessible host and LU IP addresses in a network router or disk array.
[0015]
As a result, the disk array can know the set of IP addresses for the legitimate transfer, and the means for filtering the illegal transfer provided inside can discard the transfer by the illegal IP set. Since the LU is associated with the IP address, this is a security function equivalent to the conventional LUN security.
[0016]
Similarly, since the network router can know the set of IP addresses that are legitimately transferred, the packet filtering function that has been used in the past can discard the transfer due to an illegal IP set. Since the LU is associated with the IP address, this is a security function equivalent to the conventional LUN security. Further, there is an effect that an illegal transfer can be discarded on a network router outside the disk array.
[0017]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail.
[0018]
First, the configuration of the embodiment of the present invention will be described with reference to FIG.
[0019]
In FIG. 1, a host A100, host B110, host C120, and host D130 are hosts that issue read / write requests to the disk array 200 and input / output data. 200 is a disk array according to the present invention, 300 is a router which is a device for interconnecting networks, and 400 is a management terminal for the network and disk array 200. Network A 500 and network B 510 are independent networks, and are connected to each other by router 300. Although the host A 100 and the host B 110 exist on the network A 500, the disk array 200 existing on the network B 510 can be accessed via the router 300. A network A 500 and a network B 510 are networks that use IP as a protocol.
[0020]
FIG. 2 shows an internal block diagram of the disk array in the present invention. The disk array 200 includes a network interface 210 that is connected to the IP network and solves the iSCSI protocol, a plurality of IP address holding means 212, an IP address-LUN association means 214, an IP filtering means 216, a disk array controller 220, And a disk device group 230. The disk array controller 220 is a part that performs disk array control including control of data input / output with the host, control of data division / integration specific to the disk array, and control of data input / output with the disk device group. A memory 222 for storing a program for controlling the disk, an MPU 224 for executing the program and controlling the entire disk array, and a disk cache 226 for temporarily buffering data transfer between the host and the disk device group. The disk device group 230 is composed of a plurality of disk devices arranged on the array.
[0021]
In this embodiment, it is assumed that logical units LU0-232, LU1-234, LU2-236, and LU3-238 configured by a single disk or a plurality of disks of RAID are provided.
[0022]
Next, the multiple IP address holding unit 212, the IP address-LUN association unit 214, and the IP filtering unit 216, which are features of the present invention, will be described. Conventionally, usually only one IP address is assigned to one network interface. This is because there are many network devices that do not support a plurality of IP addresses, and it is difficult to operate by assigning a plurality of IP addresses to one network interface. However, this problem is solved by the widespread use of IPv6, which assumes that a plurality of IP addresses are assigned to one network interface. The disk array 200 of the present invention has a plurality of IP address holding means 212 so that a plurality of IP addresses can be assigned to the network interface 210. The IP address-LUN association unit 214 associates an IP address, which is a network identifier, with a LUN (LU Number), which is a logical unit of disk access and is a substantial disk identifier. In this embodiment, the association itself as to which IP address number corresponds to which LUN is performed by the system administrator, and the association result is notified to the IP address-LUN association unit 214 via the management terminal 400. . This association is managed using an IP address-LUN mapping table 500 as shown in FIG.
[0023]
An example of correspondence between IP addresses and LUNs is shown in the IP address-LUN mapping table 500 of FIG. Here, the IP address is originally a long number string having a meaning as a network address, but in the present embodiment, the IP address is represented as a four-digit number string for explanation. In the IP address-LUN mapping table 500, the IP address 510 and the LU number 520 are associated with each other. In the example shown here, the IP address “0000” is associated with the LU number “LU0”, similarly “0001” and “LU1”, “0002” and “LU2”, “0002” and “ LU3 ″ is associated. Here, LU2 and LU3 are associated with the same IP address “0002”, which is a different LU as a logical unit, but is a set of LUs accessed under the same conditions in terms of network. This is because the same IP address is allocated. For example, LU2 is configured with RAID1 and high-speed access is possible, and LU3 is configured with RAID5. Both LU2 and LU3 are accessed from the same host, but when high-speed access is required, LU2 is This is effective when the LU is distinguished and accessed according to the usage, such as LU3 is normally used.
[0024]
Returning to FIG. 2, the IP filtering means 216 is one of the packet filtering functions implemented in a normal router, and examines the IP packet, and a set of a transfer source IP address and a transfer destination IP address is set in advance. If it is a group, the IP address filtering function is implemented that makes the transfer valid, and if the group is not set, determines that the transfer is invalid and invalidates the transfer. A valid IP address set is set in the IP filtering means 216 by the system administrator via the IP address security setting function 416 of the management terminal 400.
[0025]
FIG. 3 shows a block diagram of the management terminal 400 in the present invention. The management terminal 400 has management software 410 inside, and thereby realizes various managements. In this embodiment, in addition to the disk array management function 412 that is conventionally provided in the management software 410, the IP address A LUN mapping function 414 and an IP address security setting function 416 are provided. The disk array management function 412 is a program that communicates with the disk array 200 and manages the disk array 200 by providing support such as LU creation and LU release. The IP address-LUN mapping function has the IP address-LUN mapping table 500 shown in FIG. 4 and associates the actual IP address 510 with the LU number 520. The correspondence between the IP address and the LUN mapping function 414 is transmitted to the IP address / LUN associating means in the disk array 200 by communicating the correspondence between the IP address and the LU number. The IP address security setting function 416 has an accessible LU correspondence table 600 as shown in FIG. 5, and a set of accessible hosts and LUs obtained from this table is sent to the IP filtering means 216 in the router 300 and the disk array 200. By setting, a filtering function based on a set of IP addresses is realized.
[0026]
The accessible LU correspondence table 600 shown in FIG. 5 includes a host 610, a host IP address 620 representing the IP address of the host, an accessible LU 630 representing an LU that can be accessed by the host, and an IP address corresponding to the LU. Is a table having an item of LU corresponding IP address 640. In the example of FIG. 5, the host A has the IP address “0100” and can access the LU 0 associated with the IP address “0000”. Similarly, the host B has the IP address “0110” and can access LU2 and LU3 associated with the IP address “0002”. Thus, when a host can access a plurality of LUs, the host occupies a plurality of rows in the table.
[0027]
Next, the operation in this embodiment will be described. First, the system administrator uses the disk array management function 412 of the management terminal 400 based on the system design such as how much disk capacity is required for a certain host and how much access is expected from which host. Use to create a LU in the disk array 200 by specifying the RAID configuration, capacity, and the like. Here, what is different from the conventional system is that when the system administrator creates an LU, it associates with the LU and designates an IP address that serves as an identifier for access from the network. The designated IP address is associated with the LU by the IP address-LUN mapping function 414, and the association is notified to the IP address-LUN association unit 214. Further, the associated IP address is notified to the host accessing the LU. When accessing the LU, the host designates the associated IP address as the transfer destination and performs the access.
[0028]
In the present embodiment, four LUs LU0-232, LU1-234, LU2-236, and LU3-238 are created, and IP addresses “0000”, “0001”, “0002”, and “0002” are associated with each. And This association is represented in the IP address-LUN mapping table 500 of FIG. LU2 and LU3 are separate LUs composed of, for example, RAID1 and RAID5, but are associated with the same IP address because they are the same access group in terms of network.
[0029]
The IP address-LUN mapping table 500 is held internally by the IP address-LUN mapping function 414 and the IP address-LUN association unit 214.
[0030]
In this embodiment, the host A100 has LU0-232, the host B110 has LU2-236 and LU3-238, the host C120 has LU1-234, LU2-236 and LU3-238, and the host D130 has LU1-234. Shall be accessed. From here, the IP address security setting function 416 creates an accessible LU correspondence table 600. Information about which host accesses which LU is entered by the system administrator. As shown in FIG. 5, the IP address of the host A100 is “0100”, the host B110 has “0110”, the host C120 has “0120”, and the host D130 has “0130”. The system administrator knows in advance the IP address of the host that accesses the disk array 200. The accessible LU correspondence table 600 represents that access to a set of each row is permitted. The IP address security setting function 416 transfers between the IP addresses “0100” and “0000” to the router 300 and the IP filtering unit 216 based on the accessible LU correspondence table 600 (between the host A 100 and LU 0-232). , Transfer between “0110” and “0002” (between host B110 and LU2-236 and LU3-238), transfer between “0120” and “0001” (between host C120 and LU1-234), “0120” and “ It is specified that transfer between 0002 "(between host C120 and LU2-236 and LU3-238) and transfer between" 0130 "and" 0001 "(between host D130 and LU1-234) are permitted. Since the host C120, the host D130, and the disk array 200 are all on the network B510, the transfer between them does not go through the router 300. Therefore, the transfer between the IP addresses “0120” and “0001”, the transfer between “0120” and “0002”, and the transfer between “0130” and “0001” are not specified to be permitted to the router 300. good.
[0031]
The function of checking the transfer source IP address and the transfer destination IP address in the IP packet and filtering unauthorized transfer that is not permitted is one function of packet filtering provided in the conventional router. The router 300 does not require any special new function, and a conventional router can be used.
[0032]
With the above settings, when the host A100 accesses LU0-232, the IP packet having the transfer source IP address “0100” and the transfer destination IP address “0000” is used. Since the transfer between the IP addresses “0100” and “0000” is set to be permitted in the router 300, it is regarded as a valid transfer. Similarly, the IP filtering means 216 in the disk array 200 determines that the transfer is valid, The access process is performed.
[0033]
Here, if the IP packet of the transfer source IP address “0110” and the transfer destination IP address “0000” is used for the host B 110 to access the LU 0-232, it is between the IP addresses “0110” and “0000”. Since the transfer is not permitted in the router 300, it is regarded as an illegal transfer and discarded.
[0034]
If the host B 110 uses the IP packet having the transfer source IP address “0110” and the transfer destination IP address “0002” to access the LU 0-232, the router 300 cannot recognize the LU inside the IP packet, and the IP address However, the IP address “0002” is not associated with LU0 in the IP address-LUN mapping table 500 of the IP address-LUN association unit 214 in the disk array 200. Therefore, this transfer can be regarded as an illegal transfer in the disk array 200 and discarded.
[0035]
With the configuration and operation described above, according to the present embodiment, in the disk array connected to the IP network using the iSCSI technology, the combination of the transfer source IP address and the transfer destination IP address in the IP packet is equivalent to the conventional LUN security. Security functions can be realized.
[0036]
Also, in the routers connecting the networks to each other, a security function equivalent to the conventional LUN security can be realized outside the disk array with the same set of IP addresses.
[0037]
Furthermore, associating an IP address for each LU means that it appears to the host as being equivalent to a plurality of disk arrays, and the same environment as having a large number of disk arrays can be constructed with a single disk array. Therefore, it is less expensive and can be managed in a centralized manner, thereby reducing the management cost of the disk array.
[0038]
Furthermore, when migrating an LU with a large load to another interface or another device, it is possible to migrate each associated IP address, and after that, it will be accessible from the host in the same environment. There is also an effect that it can be realized.
[0039]
In this embodiment, the management information is transferred from the management terminal 400 to the disk array 200 and the router 300 via the network B510. However, as shown in FIG. Management information may be transferred using a dedicated line 700 that connects the disk array 200 and a dedicated line 710 that connects the management terminal 400 and the router 300. The dedicated lines 700 and 710 can be realized by serial communication lines, for example.
[0040]
In this embodiment, the LU 1-234 is accessed only from the host on the network B 510. In this case, if the IP address “0001” corresponding to the LU 1-234 is a valid local address only on the network B 510, Data transfer regarding LU1-234 does not go out to the outside network via the router, and is more secure in terms of security.
[0041]
Further, in the present embodiment, the example in which the host becomes the initiator and accesses the disk array has been described, but data transfer in which the disk array becomes the initiator is also conceivable for long-distance backup via the Internet. In such a case, by associating the IP address for the initiator with the LU to be backed up, the data transfer from the disk array 200 to the device on the external network also uses the transfer IP on the router 300 as in this embodiment. Security check can be performed by filtering by address set.
[0042]
In the present embodiment, the host is described as having a single network interface. However, the present invention can be similarly realized even when the host has a plurality of network interfaces and uses different IP addresses. Further, when a host assigns a plurality of IP addresses to one network interface and changes the usage for each IP address, it can be realized in the same manner as there exist a plurality of hosts.
[0043]
In this embodiment, the disk array has been described as having a single network interface. However, the present invention can be similarly realized even when the disk array has a plurality of network interfaces and uses different IP addresses. .
[0044]
In this embodiment, the disk array 200 is provided with the IP address / LUN association unit 214 and the IP filtering unit 216. However, the corresponding function may be realized by the MPU 224 and the memory 222 without providing them.
[0045]
【The invention's effect】
As described above, according to the present invention, the means for holding a plurality of IP addresses in the network interface of the disk array, the means for associating the LU in the disk array with the IP address, the IP packet transfer source IP address and the transfer A means for filtering the transfer by providing a set of destination IP addresses is provided, and the transfer between the host and the LU is performed by designating the IP address associated with the LU as the transfer destination IP address, and the management terminal Check the source IP address and destination IP address pair in the disk array and router by setting the LUN mapping and which forwarding source IP address and destination IP address pairs are allowed to be transferred Disk array and disk array Effect that on the outside of the router it is possible to realize a conventional LUN security equivalent security.
[Brief description of the drawings]
FIG. 1 is a network configuration diagram of the present invention.
FIG. 2 is an internal block diagram of a disk array in the present invention.
FIG. 3 is an internal block diagram of a management terminal according to the present invention.
FIG. 4 is a diagram illustrating a mapping table of IP addresses and LUNs.
FIG. 5 is a diagram showing a table of LUs accessible by the host.
FIG. 6 is a network configuration diagram of another configuration.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 100 ... Host A, 110 ... Host B, 120 ... Host C, 130 ... Host D, 200 ... Disk array, 300 ... Router, 400 ... Management terminal, 210 ... Network interface, 212 ... Multiple IP address holding means, 214 ... IP Address-LUN association means, 216... IP filtering means.

Claims (2)

A disk array system having a plurality of disk devices arranged in an array, wherein the disk array system includes a network interface that performs input / output with a host by iSCSI, a disk array controller that controls the disk array system, and a plurality of disk devices A means for holding an IP address; a means for associating an IP address with a logical unit; and a means for filtering the transfer according to an IP address used for the transfer. A disk array system, wherein transfer filtering is performed by a combination of an original IP address and a transfer destination IP address. 2. A network system comprising: the disk array system according to claim 1; a management terminal that manages the disk array system; and a router that interconnects the networks. A transfer source IP address on the router according to an instruction from the management terminal. A network system characterized by performing transfer filtering corresponding to a logical unit by performing transfer filtering based on a set of transfer destination IP addresses.

Images