WO2006116931A1

WO2006116931A1 - A method for guaranteeing the safety of the storage network data and the system thereof

Info

Publication number: WO2006116931A1
Application number: PCT/CN2006/000850
Authority: WO
Inventors: Yaolong Zhu; Hui Xiong; Jie Yan
Original assignee: Zhang, Jinkui; Zhou, Feng
Priority date: 2005-04-29
Filing date: 2006-04-29
Publication date: 2006-11-09
Also published as: CN1694415A; CN100385860C

Abstract

A method and a device for guaranteeing the safety of the storage network data set a safety management device on the data channel between the server cluster and the storage device cluster of the storage network. The safety management device isolates the transmitted commands and data between the server cluster and the storage device cluster and processes and manages the data safely for the transmitted orders and data between them. The method can realize the normal data process on one hand and can apply various safety measures to process all data streams or special data streams safely on the other hand to provide the safety measures and security to multi-user shared data storage and user access.

Description

Method and device for guaranteeing storage network data security

TECHNICAL FIELD The present invention relates to a security technology for a storage network, and more particularly to a method and apparatus for securing data of a storage network. BACKGROUND OF THE INVENTION Computer security is one of the hotspots of computer technology. The main technologies used are various encryption technologies or firewall technologies. However, according to statistics from relevant parties, 50% to 80% of attacks originate from within the network and are attacks inside the firewall. These attacks include the theft of stored data. At present, most of the data is stored in clear code. If the data is stolen, it will bring huge losses to the company's economic interests; some key data is even related to the interests and security of the country.

Storage networking is an important trend in the development of data storage. The security of the storage network is different from the usual network security. It is located under the usual network security firewall and is a security technology established to prevent internal theft. The security of the storage network is not the same as that of a common storage device such as a single hard disk or a single array. The storage network is stored in a multi-user shared mode. The storage device is accessed by multiple users at the same time, and the data is more easily stolen. In short, the storage network Security issues are a key issue in computer system security issues. SUMMARY OF THE INVENTION The present invention is directed to the deficiencies of the prior art, and provides a method for securing data of a storage network, which can realize storage network data storage and user access security under the condition of sharing by multiple users. The present invention also provides a storage network data security management apparatus under the method.

The method for securing storage network data is as follows: a server cluster and a storage device cluster are connected to the storage network, and the security management device is set on a command and a data channel between the server cluster and the storage device cluster in the storage network. Separating commands and data transmitted between the server cluster and the storage device cluster by the security management device, and performing data processing and data security on the commands and data transmitted between the two by the security management device management.

The method of the present invention provides a security management device for isolating commands and data between a server cluster and a storage device cluster, and the security management device performs data between the two. Processing and security management is equivalent to setting up an intelligent security administrator for the data flow between the server cluster and the storage device cluster. On the one hand, it can realize normal data processing between the server cluster and the storage device cluster. On the other hand, Security measures can be taken in the security management device. For all data flows or special: security measures such as encryption processing, permission management restrictions, etc., data storage and user access under the condition of sharing storage devices for multiple users Provides security measures and safeguards.

Further, the data processing is implemented by the security management device simulating the working mode of the storage device and the server respectively. For the I/O command of the server cluster, the security management device simulates the working mode of the storage device, and receives and Responding to the command; for the storage device cluster, the security management device simulates a working mode of the server, reads and writes the storage device in the storage device cluster, and sends an I/O command to each storage of the storage device cluster The device and/or the storage space; the data security management is implemented by performing data encryption/decryption processing on a storage protocol layer of the storage channel in the security management device.

The security management device simulates the working mode of the storage device and the server respectively, and the security management device can be set by using ordinary server hardware or embedded hardware platform, which can make the method of the invention simple and convenient. Access authorization and/or data encryption/decryption at the storage protocol layer for data processing and security management is fully compatible with existing storage systems, ie compatible with any hardware, operating system and applications.

Further, the security management device includes a hardware platform and a software platform, where the hardware platform is an ordinary server hardware or an embedded hardware, and is configured to be respectively connected to the storage device cluster and the server cluster on the physical layer and the transport layer. The device-side hardware protocol processing port and the server-side hardware protocol processing port are configured to process the storage network transmission underlying protocol; the software platform includes a device-side storage protocol module and a server-side storage protocol module respectively connected to the two hardware protocol processing ports respectively. And an encryption management module connected between the two, further comprising a configuration database connected to the three modules, wherein the two storage protocol modules implement transmission and reception of commands and analysis and storage and reception of storage network data, and the encryption management module The data is encrypted/decrypted according to the type of the command, and the configuration database stores and manages various types of information. The hardware platform is further provided with a key hardware interface; the encryption management module is further provided with a hardware encryption module and/or a software encryption module; and the software platform is further configured to be respectively connected with the configuration database for implementing access authorization management and The data encryption password management module, the rights management module, the encryption algorithm management module and the key management module, the information of the four modules are transmitted to the configuration database. The above technical measures can connect server clusters and storage device clusters with standard storage network interfaces, which are compatible with most current storage network protocols, such as Fibre Channel, iSCSI, attached network storage (NAS), and object-based storage. (0SD); The above technical solution also provides a different key and algorithm for the user by separately managing each storage device/storage space of the storage device cluster by using a key and an encrypted independent configuration of each storage space in the single storage device. Data encryption in a multi-user shared environment is implemented. The user login password, encryption key and network administrator's allocation of space permissions are combined to ensure data security. The method of the invention adopts the technical scheme of separating the key devices to quickly destroy the key and ensure data security. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic structural view of a device of the present invention;

2 is a flow chart of initialization and connection of the present invention;

Figure 3 is a flow chart of the user login of the present invention;

4 is a flow chart of writing data according to the present invention;

Figure 5 is a flow chart of reading data of the present invention;

Figure 6 is a flow chart of the disconnection of the user of the present invention.

The markers in the figure are listed below:

1 invention storage network data security management device; 2—storage device cluster; 3—server cluster; 4—storage network; 10—security platform of security management device; 20—software platform of security management device; 100—device-side hardware Protocol processing port; 110-server hardware protocol processing port; 120-hard encryption module; 130-key hardware interface; 200-device storage protocol module; 210-server storage protocol module; 220-encryption management module; Software encryption module; 240 - password management module; 250 - rights management module; 260 - encryption algorithm management module; m - key management module; 280 - configuration database. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, specific technical solutions of the present invention will be described in detail with reference to the accompanying drawings.

1 is a schematic structural diagram of a storage network data security device of the present invention. As shown in FIG. 1, the storage network data security management apparatus 1 of the present invention connects the storage device cluster 2 and the server cluster 3 through the storage network 4, and is disposed on the command and data channels between the two to isolate data and commands. The storage network data security management apparatus 1 includes a hardware platform 10 and a software platform 20, and performs data processing and data security management on data transmitted between the server cluster 3 and the storage device cluster 2. The hardware platform 10 includes a device side hardware protocol processing port 100, a server side hardware protocol processing port 110, and a hard encryption module 120. The server side hardware protocol processing port 110 is connected to the server cluster 3, and the device side hardware protocol processing port 100 is connected to the storage device cluster 2. The device-side hardware protocol processing port 100 and the server-side hardware protocol processing port 110 are composed of an underlying hardware system and a processing storage protocol layer. The device-side hardware protocol processing port 100 and the server-side hardware protocol processing port 110 can adopt the most commonly used Ethernet port and the Fibre Channel port. The actual application can adopt the flexible software and hardware configuration mode to implement the functions of each protocol layer, or Take other types of hardware ports. The key hardware interface 130 is responsible for reading the hard key, and may be any method such as the USB interface reading the USB key or the IC card reader interface reading the IC card.

The hardware platform 10 can be composed of ordinary server hardware or an embedded hardware platform developed by itself. Except for the hardware protocol processing port and key hardware interface, the other parts of the hardware are the same as the common hardware platform architecture, including the central processor, the memory for running the control program or firmware, the external memory of the storage control program or firmware, External expansion bus, etc.

The software platform 20 includes a device-side storage protocol module 200, a server-side storage protocol module 210, an encryption management module 220, a software encryption module 230, a password management module 240, a rights management module 250, an encryption algorithm management module 260, and a key management module 270. The configuration database 280.

The device-side storage protocol module 200 connects to the device-side hardware protocol processing port 100, simulates the working mode of the server, and reads and writes the storage device cluster. Specifically, the device-side storage protocol module 200 sends a high-level storage device I / 0 command to each storage device / storage space of the storage device cluster 2 to obtain its address, flag, status, and capacity, and continuously scans and monitors the storage device cluster status. The changes are stored in the configuration database 280. The server-side storage protocol module 210 is connected to the server-side hardware protocol processing port 110, simulates the working mode of the storage device, and responds to the read/write I/O command of the server cluster 3. Specifically, the server-side storage protocol module 210 obtains information of the storage device cluster 2 storage device/storage space from the configuration database 280, and receives and responds to the high-level storage device commands from the server cluster 3.

This technical solution isolates the command and data transfers between the server cluster 3 and the storage device cluster 1 while the data and commands are processed by the mode of operation of the emulation server and storage device of the present invention. The technical solution actually sets two areas: a server cluster 3 and a server side storage protocol module 210 area, in which the server cluster 3 can only see the storage network data security management device of the present invention; the storage device cluster 2 and the device The end storage protocol module 200 area, in which the storage network data security device of the present invention can only see the storage device cluster 2. Therefore, the server cluster 2 can only access the storage device cluster through the storage network data security security management device of the present invention. 2.

The data security management in this embodiment is implemented by setting access authorization management and/or encryption. The preferred solution is to perform access authorization management and encryption processing at the same time. The specific implementation process is as follows: The password management module 240 is a user (server cluster 3). The limitation of login when accessing the storage device/storage space is completed by the user and the administrator, and the user information is transmitted to the configuration database 280 if the administrator approves; the rights management module 250 is the user (server cluster 3) to the storage device. The control of the storage space access authority is completed by the user and the network administrator, and the user information, the server information of the user, and the storage device/storage space information allocated by the user are transmitted by the administrator to the configuration database 280; the encryption algorithm management module 260 A variety of encryption algorithms can be stored, implemented in hardware (through hard encryption module 120) or software (through software encryption module 230). The user selects an encryption algorithm and transmits it to the configuration database 280; the key management module 270 manages the data encryption key, which may be a soft key input by the user, or may read the hard key from the key hardware interface 130. The key management module 270 transmits the key to the configuration database 280. When receiving the read/write command of the server cluster, the configuration database 280 reads the above information, and performs encryption/decryption processing on the read/write data according to the server information, the key information, and the encryption algorithm information of the user.

The configuration database 280 manages all storage information, user information, encryption algorithm information, key information, and the like. After the user and the administrator cooperate to input a set of configuration information, the configuration #t database stores the above four kinds of information as an array. At each subsequent login, the device-side storage protocol module 200 checks whether the user and the login password are valid, and retrieves the allocated space information from the configuration database 280 to the user for reporting to the user. When the user reads and writes the above space, the device side storage protocol module 200 encrypts/decrypts the data by hardware or software according to the key information and the encryption algorithm information.

2 is a flow chart of initialization and connection of the present invention. As shown in (a) of FIG. 2, the device-side hardware protocol processing port 100 and the device-side storage protocol module 200 connected to the storage device cluster 2 simulate the working mode of the server. In this manner, the storage network data security management device 1 of the present invention actively sends a high-level storage device command to the storage device cluster 2 to obtain the address, flag, status, and capacity of each storage device/storage space of the storage device cluster 1. The storage network data security management apparatus 1 of the present invention sets a timing scanning scheme, and cyclically detects each storage in the storage device cluster 2, due to the presence of a new device, a disconnection of the original device, and an error in the process of reading and writing. The status of the device/storage space is updated with the configuration database 280.

As shown in FIG. 2(b), the server-side hardware protocol processing port 110 and the server-side storage protocol processing module 210 connected to the server cluster 3 simulate the storage device working mode, receive and respond to the service. High-level storage device commands from the server cluster 3, such as read memory attribute commands, read status commands, read capacity commands, read and write commands, and the like. All storage device/storage state parameters are taken from configuration database 280.

Figure 3 is a flow chart of the user login of the present invention. As shown in Figure 3, when the user needs storage space, the network administrator is issued an application, the network administrator confirms that the user can use the storage resource, the user information, the server information and the storage user's storage space information is stored in the configuration database 280; The user determines the login password, encryption algorithm, and key, and also stores it in the configuration database 280.

The user logs in to the storage network data security device 1 of the present invention by using the login password. The present invention retrieves the configuration database 280 and confirms that the user name, password, and server are valid, and allows the user to log in.

The above password and key are isolated from the network administrator. The network administrator only knows that there is a password and a key, but does not know the content. That is, the network administrator has the right to allocate storage devices/storage space without access to storage devices/storage space.

4 is a flow chart of writing data of the present invention. As shown in FIG. 4, after receiving the write command, the present invention takes the encryption algorithm and the key from the configuration database 280, encrypts the write data by hardware or software, and writes the corresponding storage device/storage space.

Figure 5 is a flow chart of the read data of the present invention. As shown in FIG. 5, after receiving the read command, the present invention reads data from the corresponding storage device/storage space, and then extracts the read data by hardware or software according to the encryption algorithm and the key extracted from the configuration database 280. Decrypt, return the data to the server.

Figure 6 is a flow chart of the disconnection of the user of the present invention. As shown in FIG. 6, to ensure data security, the present invention deletes the key from the configuration database 280 when the user disconnects. If the user has further requirements, the password for the user login can also be cleared.

The specific embodiments of the present invention have been described above, but are not limited thereto, and the present invention is not limited in any form. It should be noted that many related variations and modifications can be made by those skilled in the art in light of the teachings of the present invention, but these will fall within the scope of the present invention.

Claims

Rights request

A method for securing data of a storage network, wherein the storage network is connected with a server cluster and a storage device cluster, wherein the security management device is set on a data channel between the server cluster and the storage device cluster in the storage network. Separating commands and data transmitted between the server cluster and the storage device cluster by the security management device, and performing data processing and data security on the commands and data transmitted between the two by the security management device management.

2. The method for securing data security of a storage network according to claim 1, wherein the data processing is implemented by the security management device simulating a working mode of the storage device and the server respectively, and the I of the server cluster. /O command, the security management device simulates an operating mode of the storage device, and receives and responds to the command; for the storage device cluster, the security management device simulates a working mode of the server, reads and writes in the cluster of the storage device Storing devices and transmitting I/O commands to respective storage devices and/or storage spaces of the storage device cluster; the data security management is to perform access authorization on a storage protocol layer of a storage channel in the security management device and/or Or data encryption/decryption processing to achieve.

The method for securing data security of a storage network according to claim 1 or 2, wherein the security management device comprises a hardware platform and a software platform, and the hardware platform is an ordinary server hardware or an embedded hardware, and is configured. a device-side hardware protocol processing port and a server-side hardware protocol processing port respectively connected to the storage device cluster and the server cluster at a physical layer and a transport layer, and configured to process a storage network transmission underlying protocol; the software platform includes The device storage protocol module, the server storage protocol module and the encryption management module connected between the two hardware protocol processing ports further comprise a configuration database connected to the three modules, and the two storage protocols The module implements the »| and the analysis and storage of the network data, the encryption management module encrypts/decrypts the data according to the type of the command, and the configuration database stores and manages various types of information.

The method for securing data security of a storage network according to claim 3, wherein the hardware platform is further provided with a key hardware interface; the encryption management module is further provided with a hardware encryption module and/or a software encryption module; The software platform is further provided with a password management module, a rights management module, an encryption algorithm management module and a key management module, which are respectively connected to the configuration database for implementing access authorization management and/or data encryption, and information of the four modules. Both are passed to the configuration database.

The method for securing data security of a storage network according to claim 4, wherein the working mode of the simulation server is through a device-side storage protocol module and a device-side hardware protocol. After the processing port is implemented, the device-side storage protocol module sends a command to each storage device/storage space of the storage device cluster to obtain attributes such as address, flag, status, and capacity, and continuously scans and monitors the change of the cluster state of the storage device to perform data. Updating, and storing the foregoing information in the configuration database; the working mode of the simulated storage device is implemented by the server-side storage protocol module and the server-side hardware protocol processing port, and the server-side storage protocol module obtains the storage device from the configuration database. The information of the cluster storage device/storage space, which is received by the information and responds to the command from the server cluster; for the read data and the write data command in the command, the encryption management module needs to perform the encryption algorithm and the key in the configuration database. The storage/storage space in the storage device cluster can be read and written after encryption/decryption processing.

6. The method for securing storage network data according to claim 4, wherein the access authorization management and the data encryption/decryption are implemented as follows: The password management module sets a restriction on the login when the user accesses the storage device/storage space. And set to be completed by the user and the administrator, and the generated user information is transmitted to the configuration database when the administrator approves; the rights management module sets the user's control over the access authority of the storage device/storage space, and is set to Completed by the user and the network administrator, the generated user information, the server information of the user, and the storage device/storage space information allocated by the user are transmitted by the administrator to the configuration database; the encryption algorithm management module stores multiple encryption algorithms. The algorithms are implemented by a hardware encryption module or a software encryption module, and the user selects an encryption algorithm and transmits the data to the configuration database; the key management module manages the data encryption key, and the key may be a soft key input by the user, or may be from the Key hardware interface read in The hard key, the key management module transmits the key to the configuration database. When receiving the read/write command of the server cluster, the configuration database reads the above information, and reads and writes according to the server information, the key information, and the encryption algorithm information of the user. The data is encrypted/decrypted.

A storage network data security management device, wherein the storage network is connected with a server cluster and a storage device cluster, wherein the storage network data security management device is disposed between the server cluster and the storage device cluster in the storage network. The command and data channels are composed of a hardware platform and a software platform, and perform data processing and data security management on commands and data transmitted between the server cluster and the storage device cluster.

8. The storage network data security management apparatus according to claim 7, wherein the hardware platform is an ordinary server hardware or an embedded hardware, and is disposed at a physical layer and respectively with the storage device cluster and the server cluster. a device-side hardware protocol processing port and a server-side hardware protocol processing port connected to the transport layer for processing a storage network transmission underlying protocol; the software platform includes a device-side storage protocol module and a server respectively connected to two hardware protocol processing ports The end storage protocol module and the encryption management module connected between the two further comprise a configuration database connected to the three modules, wherein the two storage protocol modules implement command transmission and analysis and storage and storage network data transmission and reception. The encryption management module encrypts/decrypts data according to the type of the command, and the configuration database stores and manages various types of information.

The storage network data security management device according to claim 8, wherein the hardware platform is further provided with a key hardware interface; the encryption management module is further provided with a hardware encryption module and/or a software encryption module; The software platform is further provided with a password management module, a rights management module, an encryption algorithm management module and a key management module respectively connected to the configuration database for implementing access authorization management and data encryption/decryption, and the information of the four modules is Transfer to the configuration database.