WO2017183089A1

WO2017183089A1 - Computer, computer system, and program

Info

Publication number: WO2017183089A1
Application number: PCT/JP2016/062300
Authority: WO
Inventors: 洋中越; 智大川口
Original assignee: 株式会社日立製作所
Priority date: 2016-04-19
Filing date: 2016-04-19
Publication date: 2017-10-26

Abstract

This computer, serving as storage, is provided with a processor which executes a storage program for processing commands such as I/O commands received from hosts and remote copy commands exchanged with remote storage, and a memory which stores the storage program and information used by the processor to execute the storage program, wherein: the memory stores, in advance, command control information for limiting command types which each host or remote storage establishing a connection with the aforementioned storage is permitted to use; and upon receiving a command from a transmitting host or remote storage, the processor refers to the command control information and determines whether the received command is a command that the transmitting host or remote storage is permitted to use, and if so, the processor executes the received command using the storage program.

Description

Computer, computer system, and program

The present invention relates to software storage.

In recent years, the migration of enterprises to the cloud has expanded. Against this background, attention has been focused on software storage that operates as software on the cloud and has enterprise functions such as high reliability and performance. Conventional storage systems for enterprises have been managed by connecting to a network called SAN (Storage Area Network), which is different from an IP network to which a host using storage is connected. The SAN is a fiber channel network, and SCSI commands are exchanged on the network.

On the other hand, software storage operating on the cloud is connected to the same IP network as the host. In an IP network, a SCSI command cannot be transmitted / received like a SAN. For this reason, the host and the storage communicate with each other by using a protocol for sending and receiving a SCSI command called iSCSI in an IP packet.

Since the SAN is physically separated from the IP network, the storage system can be protected from connection by a malicious host by restricting the hosts connected to the SAN to trusted hosts. On the other hand, a host used by a general user is also connected to the IP network. Therefore, software storage has a risk of peeping or unauthorized access to communication between storages flowing through the IP network.

On the other hand, Patent Document 1 discloses a technology for performing iSCSI communication on a communication path established between a host and a storage using IPsec. IPsec is a communication protocol that encrypts communication contents by encryption encapsulation and adds a dedicated header called an authentication header. Encryption protects data from peeping of IP packets and secures communication reliability with a dedicated header, thereby limiting access from unauthorized hosts.

US Pat. No. 7,353,542

However, IPsec used in iSCSI can realize protection of communication data in the IP layer, but cannot secure security in the SCSI layer. Specifically, in the SCSI protocol, basic commands such as data reading and writing are transferred with a data length of 10 bytes (hereinafter also simply referred to as “B”). On the other hand, in the SCSI protocol, arbitrary vendor-specific commands of both size and contents are allowed.

Conventional storage systems use vendor-specific commands when communicating with other storage systems via the SCSI protocol. Specifically, when copying in units of volumes between storage systems, it is necessary to maintain consistency between the host write order to the copy source volume and the data copy order to the copy destination volume. . Conventional storage systems use vendor-specific commands for such complex control. In general, a vendor-specific command does not fit in the SCSI protocol 10B, and has a command size of 16B or 32B.

Here, in order to make software storage correspond to a vendor-specific command exceeding 10B, a large buffer such as 32B is prepared for command processing in an instance in which software storage is installed. Note that the instance may be in any form as long as it provides an OS for operating the software storage, a CPU, a memory, a drive, and a network function necessary for the OS operation. For example, the instance may be a machine directly installed on hardware, a virtual machine operating on a hypervisor, or may be in a container area managed by container management software.

Using iSCSI and IPsec, software storage can communicate with only authorized hosts on the SCSI layer. The host can send and receive a SCSI command for performing I / O and the like to the software storage.

However, there is a possibility that an unauthorized application is installed on the host even if the user operating the host is not malicious. Such an unauthorized application may then send an unauthorized command to the software storage. Normally, an illegal command is longer than 10B. However, since the software storage has a large size buffer, an illegal command is received and an attempt is made at this time.

-Since the format of this illegal command is not interpreted as that of a SCSI fixed command, the illegal command is presumed to be a vendor-specific command and passed to the upper storage software. When storage software processes an illegal character string of such an illegal command, in the worst case, a memory leak or a memory access violation may occur, and a security accident may be induced in which instance control is passed to a malicious attacker. There is sex.

An object of the present invention is to provide a technique for improving the security against an illegal command while allowing a command whose software storage exceeds a predetermined command size.

In order to achieve the above object, a computer according to an aspect of the present invention includes a processor that executes a storage program for processing an I / O command from a host as a storage and a command including remote copy with the remote storage, and the storage A memory storing a program and information for the processor to execute the storage program, and the memory limits a command type individually permitted to a host or a remote storage connected to the storage. Command control information is stored in advance, and when the processor receives a command from the host or the remote storage, the processor refers to the command control information and determines whether the command is a command permitted to the command request source. Judgment, The command executed by the storage program when it is acceptable.

According to the present invention, since the command type permitted for each host or remote storage can be set by the command control information, it is possible to improve the security against illegal commands while allowing a predetermined type of command.

1 is a block diagram illustrating a functional configuration example of a computer system 10 according to Embodiment 1. FIG. 2 is a block diagram showing an example of a hardware configuration of a computer system 10. FIG. It is a figure which shows an example of the structure information table. It is a figure which shows an example of the key information table. It is a figure which shows an example of the pair information table. It is a flowchart which shows the process of the initial setting of the computer system 10 by the orchestrator 130 of the management infrastructure 103, or an administrator. 3 is a block diagram showing a detailed configuration of a SCSI access control unit 113. FIG. 6 is a diagram illustrating an example of a SCSI command list 205. FIG. It is a figure which shows an example of the SCSI command control information 125. It is a figure which shows the initialization sequence of the SCSI control part. 3 is a flowchart showing command processing in a command processing unit 123 of a SCSI control unit 111. 4 is a flowchart of an access control process by a SCSI access control unit 113. It is a block diagram which shows the function structural example of the computer system 20 which concerns on Example 2. FIG. It is the figure which showed the connection of the SCSI access control part 113 in Example 2, and each other part.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In addition, since the same number shown to each figure has the same function, description is abbreviate | omitted.

FIG. 1A is a block diagram illustrating a functional configuration example of the computer system 10 according to the first embodiment. The computer system 10 includes

hosts

100 and 101, a remote storage 102, a management infrastructure 103, and a software storage instance 104.

FIG. 1B is a block diagram illustrating a hardware configuration example of the computer system 10. The software storage server 104A is a computer on which the above-described software storage instance 104 is created. The software storage server 104A is connected to the

hosts

100 and 101, the remote storage 102, and the management infrastructure 103 by an IP network 900.

The remote storage 102 is a conventional storage.

Software storage instance 104 is an instance in which a storage function is realized by software. The software storage instance 104 is created on the computer and operates to make the computer function as a storage. The software storage instance 104 may be created on one computer, or may be created by distributing functions on a plurality of computers. The software storage instance 104 may be created on a computer prepared exclusively or on a computer that is also used as another device.

The software storage server 104A is a computer capable of processing a plurality of data communication protocols. For example, the software storage server 104A uses iSCSI (Internet Small Computer System Interface) as an example of a data communication protocol to perform data communication with the

hosts

100 and 101, the remote storage 102, and the management infrastructure 103.

In the present embodiment, the software storage server 104A performs data communication using iSCSI, but the present invention is not limited to this. As another example, the software storage server 104A includes an FCP (Fibre Channel Protocol), an iSCSI (Internet Small Computer System), an NFS (Network File System, and a CIFS (CommonHTP). The data communication protocol may be used to perform data communication with the

hosts

100 and 101, the remote storage 102, and the management infrastructure 103.

For example, the software storage server 104A receives an I / O request from the

hosts

100 and 101 via the IP network 900, executes the I / O processing, and then sends a processing result (I / O response) to the host 100, Return to 101. The software storage server 104A may be fixedly installed in a facility such as a data center, or may be movable like a container type, and the geographical position may be changed as necessary. Further, the software storage server 104A may be configured by a plurality of geographically separated computers instead of a single computer.

The management infrastructure 103 is a computer that manages the system configuration of the computer system 10, various settings for operating the remote storage 102, software executed by the software storage server 104A, and various settings used when the software storage server 104A executes the software. It is. The management infrastructure 103 stores a management program, and executes various processes including the management function described above by executing the management program.

For example, the management infrastructure 103 is a pair indicating the

host

100, 101 or remote storage 102 connected as a pair with the software storage instance 104, and the command type permitted to be executed for each

host

100, 101, or remote storage 102. It manages information and notifies the software storage instance 104 as appropriate.

The IP network 900 is, for example, the Internet, a LAN (Local Area Network), a WAN (Wide Area Network), a SAN (Storage Area Network), a wireless LAN, a mobile phone communication network, and the like. The network 220 may be composed of a plurality of types of communication networks instead of a single communication network.

Hosts

100 and 101 are servers on which a client operated by a user or an application connected to a remote storage 102 or a software storage instance 104 is installed. The

hosts

100 and 101 may be fixedly installed in a facility such as a data center, or may be movable such as a container type and change the geographical position. As an example of the

hosts

100 and 101, a mobile phone including a smartphone or a general-purpose computer such as a personal computer is assumed. Further, the

hosts

100 and 101 may be constituted by a plurality of different computers instead of a single device.

As shown in FIG. 1A, the software storage server 104A includes a memory 420, an HBA (Host Bus Adapter) 431, an NIC (Network Interface Card) 432, a disk device 460, and a CPU (Central) that is a control arithmetic unit connected thereto. Processing unit) 410.

Instead of or in addition to the memory 420, another type of storage resource may be employed. Instead of the HBA 431 and the NIC 432, another type of communication interface device may be employed.

CPU 410 executes a computer program stored in memory 420. The CPU 410 has a plurality of CPU cores 411 that are arithmetic units. Each CPU core 411 can operate independently and executes a computer program in parallel.

The CPU core 411 is a processor core that reads various programs including a storage program, an OS (Operating System), and an I / O processing program from the memory 420 and executes them. The CPU core 411 may be simply called a processor.

The memory 420 stores computer programs and other data. The memory 420 may include a cache that temporarily stores data received from the

hosts

100 and 101 and data to be transmitted to the

hosts

100 and 101.

The HBA 431 and the NIC 432 are connected to the IP network 900 and used for data communication with the management infrastructure 103 and the

hosts

100 and 101.

The disk device 460 includes an SSD (Solid State Drive) 451 and an HDD (Hard Disk Drive) 452 which are secondary storage devices of the software storage server 104A. The secondary storage device stores I / O processing data as storage. The disk device 460 is typically the SSD 451 and the HDD 452 illustrated in FIG. 1B, but may be anything as long as it can store block format data. In this embodiment, the disk device 460 is illustrated as an example of the storage device, but the present invention is not limited to this. As another example, the disk device 460 may be a device including a tape archive or an optical disk library such as a DVD or a CD. Hereinafter, the SSD 451 and the HDD 452 are collectively referred to as a disk device 460. The disk device 460 may be a storage device.

The function of each device will be described with reference to FIG. 1A.

The management infrastructure 103 includes an orchestrator 130, an information device management unit 131, a storage access management unit 132, a configuration information table 133, a key information table 134, and a pair information table 135.

The orchestrator 130 is a functional unit that prepares and executes operations manually executed by an administrator. The orchestrator 130 enables the administrator to set the provisioning in the computer system 10 or the system configuration of the computer system 10 to each device without manually performing the operation.

The information device management unit 131 collects and manages the configuration information of the

hosts

100 and 101, the remote storage 102, the management infrastructure 103, and the software storage instance 104. Information collected by the information device management unit 131 is stored in the configuration information table 133.

The storage access management unit 132 manages information related to the connections between the

hosts

100 and 101 and the remote storage 102 and the software storage instance 104. Information managed by the storage access management unit 132 includes a key information table 134 and pair information 135.

The key information table 134 is a table for storing key information required to securely connect the

hosts

100 and 101 and the remote storage 102 and the software storage instance 104. In this embodiment, a method using a public key authentication method is adopted. However, the present invention is not limited to this. In this embodiment, the key information table 134 manages a pair of a public key and a secret key necessary for communication using the public key authentication method.

The pair information 135 is a table for managing information on the form of connection with the

hosts

100 and 101 connected to the software storage instance 104 or the remote storage 102.

Details of the key information table 134 and the pair information 135 will be described later with reference to FIGS. 2A to 2C.

The software storage instance 104 includes a software storage 110, a SCSI control unit 111, an IP control unit 112, a SCSI access control unit 113, and a drive group 114, and is an instance that provides a storage service as software. An instance may be provided in any form as long as an OS for operating software storage and a CPU, memory, drive, and network functions necessary for OS operation are provided. The instance may be a machine in which a program is directly installed on hardware, a virtual machine that operates on a hypervisor, or a container area managed by container management software.

The software storage 110 includes a command control unit 120, a data control unit 121, and a drive control unit 122. The command control unit 120 passes the SCSI command received from the SCSI control unit 111 to the data control unit 121, and passes the SCSI command generated by the data control unit 121 to the SCSI control unit 111. The data control unit 121 reads and writes data to the drive group 114 by communicating with the drive control unit 122 according to the SCSI command received from the command control unit 120. For this purpose, the drive control unit 122 controls the drive group 114 to read data from the drive group 114 and write data to the drive group 114 requested by the data control unit 121.

The SCSI control unit 111 is a protocol stack that includes a command processing unit 123 that interprets SCSI commands and is in charge of transmission and reception of SCSI commands.

The IP control unit 112 includes an IPsec processing unit 124 that performs IPsec processing, and is a protocol stack in charge of IP communication. The CPU 410 serving as the IP control unit 112 acquires an encryption key for encrypting communication with the

host

100, 101 or remote storage 102 from the management infrastructure 103, and uses the encryption key with the

host

100, 101 or remote storage 102. Used to encrypt communication. Since the software storage instance 104 encrypts communication with the

hosts

100 and 101 or the remote storage 102, security against peeping can be improved.
Although not particularly specified in FIG. 1A, the IP control unit 112 may control the transport layer such as TCP and UDP. In this embodiment, the transport layer and the control for the transport layer are not particularly limited.

The SCSI access control unit 113 performs access control at the SCSI layer.

In this embodiment, the CPU 410 reads and executes the storage program stored in the memory 420. The storage program is a program for processing I / O commands from the

hosts

100 and 101 and commands including remote copy with the remote storage 102 as storage. The memory 420 also stores information for the CPU 410 to execute the storage program.

In relation to the access control, the memory 420 stores in advance command control information for limiting the command types individually permitted for the

hosts

100 and 101 or the remote storage 102 connected to the storage. When receiving a command from the

host

100 or 101 or the remote storage 102, the CPU 410 serving as the SCSI access control unit 113 refers to the command control information and determines whether or not the command is a command permitted to the command request source. If allowed, execute the command by the storage program. According to the present embodiment, the command type permitted for each host or remote storage can be set by the command control information, so that it is possible to improve the security against illegal commands while allowing a predetermined type of command.
Further, the command control information further limits the command size permitted for each command type permitted for the

hosts

100 and 101 or the remote storage 102. Based on the command control information, the CPU 410 sets the size of a buffer that holds a command to be processed, and when a command is received from the

host

100 or 101 or the remote storage 102, if the command can be stored in the buffer, it is stored in the buffer. Store and refer to the command control information, and execute by the storage program when the command is a command type permitted to the request source of the command. Software storage can discard illegal commands based on the command size by setting an appropriate buffer size for the size of the allowed command. Can be prevented.
Details of access control by the SCSI access control unit 113 will be described later with reference to FIGS. 5A and 5B.

2A to 2C show various information managed by the management infrastructure 103. FIG. FIG. 2A is a diagram illustrating an example of the configuration information table 133. FIG. 2B is a diagram illustrating an example of the key information table 134. FIG. 2C is a diagram illustrating an example of the pair information table 135.

The table T1 shown in FIG. 2A is an example of the configuration information table 133, and is a table that manages the state of system components. The table T1 stores information indicating the state of each system component constituting the computer system 10.

Referring to FIG. 2A, the table T1 stores connection addresses, component names, types, and states for the

hosts

100 and 101, the remote storage 102, and the software storage instance 104 as system components. However, the information to be managed is not limited to this example.

The management infrastructure 103 acquires such information from each system component. Although this acquisition method is not specifically limited, For example, you may acquire by communication using protocols, such as SNMP. As another example, an agent for acquiring unique information is installed in each of the

hosts

100 and 101, the remote storage 102, and the software storage instance 104, and the management infrastructure 103 receives information sent from the agent, It may be stored.

The table T2 shown in FIG. 2B is an example of the key information 134. The table T2 is a table for storing encryption keys for maintaining a peer-to-peer secure connection between devices in the computer system 10 using iSCSI IPsec. In this embodiment, the IPsec encryption method is not limited, but here, as an example, a public key method is adopted. Therefore, the public key and public key of the public key method are stored in the table T2. In the public key method, the public key is distributed to the authenticating device, and the secret key is distributed to the authenticating device. Even if the public key is made public, it will not be a security problem, but the private key should not be made public. Therefore, for example, when distributing the secret key to the host 101, care must be taken not to leak it to the outside.

The table T3 shown in FIG. 2C is an example of the pair information 135. The table T3 is a table that stores pair information indicating logical connection states in which the

hosts

100 and 101, the remote storage 102, and the software storage instance 104 are connected to each other. In this embodiment, the table T3 stores two components to be paired and the type of the pair.

Specifically, referring to the table T3, the first line indicates that the host 101 and the software storage instance 104 constitute a logical connection, and the connection is a connection that performs only I / O. Similarly, the second row of the table T3 indicates that the remote storage 102 and the software storage instance 104 constitute a logical connection, and the connection is a connection for performing remote copy for copying volume data between the storages.

FIG. 3 is a flowchart showing the initial setting process of the computer system 10 by the orchestrator 130 of the management infrastructure 103 or the administrator.

First, the premise of this embodiment, which is necessary in the following explanation, is summarized here.

In the present embodiment, the target of setting is the software storage instance 104. The orchestrator 130 or the supervisor sets various settings related to the software storage instance 104 for the host 101, the remote storage 102, and the software storage instance 104.

For the iSCSI service provided by the software storage instance 104, the host 101 can connect only I / O, and the remote storage 102 can connect only the copy control command. On the other hand, the host 100 is, for example, a low-reliability host or a host operated by a user in another department. Therefore, it is assumed that the host 100 cannot use I / O and copy control commands.

Therefore, in the host 101, the remote storage 102, and the software storage instance 104, it is necessary to perform iSCSI and IPsec connection settings and access control at the SCSI layer, which is an embodiment of the present invention.

In addition, regarding the remote copy performed between the remote storage 102 and the software storage instance 104, in this embodiment, the remote storage 102 is fixed to the iSCSI initiator and the software storage instance 104 is fixed to the target for the sake of simplicity. To do. When data is copied bidirectionally, or copying is only in one direction from the remote storage 102 to the software storage instance 104, the copy control command needs to be exchanged in both directions. Both storage instances 104 need to be iSCSI initiators.

Hereinafter, the initial setting process will be described with reference to FIG.

In FIG. 3, an orchestrator 130 or an administrator who automatically performs management work using a software program generated by the administrator connects the host 101 and the software storage instance 104 via the storage access management unit 132 of the management infrastructure 103. A pair for performing only I / O is registered in the pair information table 135 (F1).

Subsequently, the orchestrator 130 or the administrator registers the remote storage 102 and the software storage instance 104 in the pair information table 135 as a pair for performing only remote copy via the storage access management unit 132 of the management infrastructure 103 ( F2). As a result, T3 is generated.

Subsequently, the orchestrator 130 or the administrator distributes the public key to the host 101 and the remote storage 102 (F3). Subsequently, the orchestrator 130 or the administrator distributes the secret key to the software storage instance 104 (F4). As described above, data is copied bidirectionally between the remote storage 102 and the software storage instance 104, or copying is only in one direction from the remote storage 102 to the software storage instance 104, but the copy control command is bidirectional. If exchange is required, not only the public key but also the private key must be distributed to the software storage instance 104, and not only the private key but also the public key must be distributed to the remote storage 102.

Finally, the orchestrator 130 or the administrator sends the information described in the pair information table 135 and the information described in the configuration information table 133 to the SCSI access control unit 113 of the software storage instance 104 (F5). The reception processing of the SCSI access control unit 113 will be described later with reference to another drawing.

FIG. 4 is a block diagram showing a detailed configuration of the SCSI access control unit 113. The SCSI access control unit 113 includes a pair information reception unit 200, a SCSI command control information generation unit 201, a command buffer size notification unit 202, a confirmation request transmission / reception unit 203, and a confirmation request verification unit 204. A list 205 and SCSI command control information 125 are held.

The pair information receiving unit 200 receives the information of the pair information table 135 and the information of the configuration information table 133 from the IP control unit 112. The SCSI command control information generating unit 201 generates SCSI command control information based on the pair information received by the pair information receiving unit 200 and the SCSI command list 205.

In connection with the generation of the command control information, the memory 420 holds command list information that prescribes a command size for each command type in advance. The CPU 410 serving as the SCSI command control information generation unit 201 can be executed from the management infrastructure 103 that manages the system configuration for each

host

100, 101 or remote storage 102 that is connected in a pair with the storage, and for each host or remote storage. Pair information indicating a command type is obtained, and command control information is generated based on the pair information and command list information. Since the command list is held in advance, the command control information can be generated based on the system configuration information obtained from the management infrastructure 103.
The command buffer size notifying unit 202 notifies the buffer size that the SCSI control unit 111 should prepare initially. The confirmation request transmission / reception unit 203 receives the SCSI command validity confirmation request sent from the SCSI control unit 111 and sends the confirmation result returned from the confirmation request verification unit 204 to the SCSI control unit 111. The confirmation request verification unit 204 verifies the SCSI command validity confirmation request sent from the SCSI control unit 111 via the confirmation request transmission / reception unit 203 and returns the verification result. The SCSI command list 205 is a list table of SCSI commands and is used when generating SCSI command control information.

FIG. 5A is a diagram showing an example of the SCSI command list 205. FIG. 5B is a diagram illustrating an example of the SCSI command control information 125. FIG. 5A shows a table T4 as an example of the SCSI command list 205. FIG. 5B shows a table T5 as an example of the SCSI command control information 125. However, the SCSI command list 205 and the SCSI command control information 125 are not limited to the tables T4 and T5, respectively.

The table T4 shown in FIG. 5A is a table storing each SCSI command, the size of the command, and the type to which the command corresponds. For example, the first line describes a READ command that is a command for reading data. The READ command has a command size of 10B and is a command for I / O. In this embodiment, READ and WRITE are commands for reading and writing data. Both the READ command and the WRITE command have a command size of 10B. Similarly, COPY and SYNC are commands for copy processing and synchronization processing, respectively. The command size of these commands is 32B.

When the pair information receiving unit 200 receives the pair information sent from the management infrastructure 103, the SCSI access control unit 113 sends the pair information to the SCSI command control information generating unit 201. The SCSI command control information generation unit 201 filters the SCSI command list 205 with the received pair information to generate SCSI command control information 125. An example of the generation result is the table T5.

The table T5 includes, as items, a connection destination host name, an IP address of the host, a command type permitted to the host, and a command size permitted to the host. Table T5 exemplifies connection control information between the software storage instance 104 and the host 101 and remote storage 102. As described above, in the table T5, only the I / O command is permitted for the host 101 and only the copy control command is permitted for the remote storage 102.

Specifically, when the pair information receiving unit 200 receives the pair information on the first row of the table T3, the pair type “I / O” is used to filter the “type” item of the table T4. As a result, READ and WRITE commands are extracted. Subsequently, information regarding the host 101 which is pair target information included in the pair information is extracted from the configuration information sent together with the pair information. As a result, the SCSI command control information generation unit 201 can generate the table T5 as the SCSI command control information 125.

Next, initialization of the SCSI control unit 111 will be described with reference to FIG. FIG. 6 is a diagram showing an initialization sequence of the SCSI control unit 111.

The SCSI control unit 111, particularly the command processing unit 123 that processes a SCSI command passed from the IP control unit 112, needs to secure a buffer for holding the received command. As shown in the table T4, since the SCSI command has a different size depending on the command content, the SCSI access control unit 113 notifies the command processing unit 123 of a buffer size that can hold the permitted SCSI command.

In the SCSI access control unit 113 shown in FIG. 4, after the SCSI command control information generating unit 201 generates the SCSI command control information 125, the command buffer size notifying unit 202 includes the SCSI control unit 111 as shown in FIG. 6. The command processing unit 123 is notified of the maximum size among the permitted command sizes described in the SCSI command control information 125 (S1). Specifically, in the example of the table T5, the maximum size of 32B information is notified. Receiving the buffer size, the command processing unit 123 sets the buffer size to the notified size value (S2).

Next, the SCSI command processing of the SCSI control unit 111 will be described with reference to FIG. FIG. 7 is a flowchart showing command processing in the command processing unit 123 of the SCSI control unit 111.

In the SCSI control unit 111, the command processing unit 123 receives the SCSI command from the IP control unit 112 (F11), and transmits the received command and information regarding the transmission source to the SCSI access control unit 113 (F12).

Next, when the command processing unit 123 returns a result indicating that the command is valid (F13) from the SCSI access control unit 113, the command processing unit 123 interprets the command (F14), and changes the contents of the command to the software storage 110. (F15). On the other hand, when a result that is not valid is returned from the SCSI access control unit 113 in F13, the command processing unit 123 performs error processing without interpreting the command (F16).

The error handling performed here is not particularly limited. There are many specific examples, although neither is recommended. For example, the error process may be a process of ending without doing anything, or a process of notifying an error to the transmission source.

Also, the information returned by the SCSI access control unit 113 to indicate whether the command is valid or invalid is not particularly limited. Here, as an example, the SCSI access control unit 113 returns a code indicating a confirmation result (for example, information indicating validity or fraud) and a size at which the command should be interpreted. As a result, when the confirmation result that the command is valid is notified, the command processing unit 123 interprets the command by the notified size.

Next, processing performed by the SCSI access control unit 113 in response to the confirmation request transmitted from the SCSI control unit 111 in F12 of FIG. 7 will be described using FIG. FIG. 8 is a flowchart of the access control process by the SCSI access control unit 113.

The SCSI access control unit 113 receives the command transmitted by the SCSI control unit 111 and its transmission source information (F21), and determines whether or not the received command is a command permitted by the transmission source by using a table of the SCSI command control information 125. It judges using (F22).

Specifically, when a READ command is sent from the host 101, the table T5 is referred to based on the transmission source information, and it is determined whether or not the command is a command permitted to the host 101. In the example of the table T5 shown in FIG. 5B, it is determined that the READ command is a permitted command, and at the same time, the permitted command size necessary for the interpretation is determined.

On the other hand, when a SYNC command is sent from the host 101, the table T5 is referred to based on the transmission source information, and it is determined whether or not the SYNC command is a command permitted to the host 101. As a result, it is found that the SYNC command is not permitted.

If it is determined in F22 that the received command is a command permitted by the transmission source, that is, it is determined to be valid, the SCSI access control unit 113 returns a message indicating that the command is valid to the SCSI control unit 111. (F23). Here, as shown in the above example, a confirmation code indicating validity and the size of the command are returned.

On the other hand, if it is determined in F22 that the received command is not a command permitted by the transmission source, that is, it is illegal, the SCSI access control unit 113 sends a message indicating that it is illegal to the SCSI control unit 111. Return (F24). Here, referring to the previous example, a confirmation code indicating fraud shall be returned. If it is illegal, it is not necessary to return the permitted command size, but in order to unify the format with the legal case, the permitted command size in the message may be set to zero and returned.

In this embodiment, the CPU 410 executes a storage program, whereby the software storage 110 that operates as a storage, the command processing unit 123 that controls whether or not the processing by the software storage 110 is permitted for a command, and command processing A SCSI access control unit 113 that manages command control information for individually determining whether each of the command request sources determines whether or not the unit 123 permits processing for the command is constructed. The SCSI access control unit 113 includes a pair information receiving unit 200 that receives pair information from the management infrastructure 103, a command control information generating unit 201 that generates command control information based on the pair information and command list information, and command control information. A command buffer size notifying unit 202 that notifies the command processing unit 123 of a command buffer size that is a size of a buffer that temporarily holds a command determined based on the command size specified in the command processing, and a command processing from the command processing unit 123 Confirmation request transmission / reception unit 203 that transmits / receives a control signal for inquiry processing as to whether to permit or not, and a command for which confirmation is requested by a control signal transmitted / received by confirmation request transmission / reception unit 203 is permitted. A confirmation request verification unit 204 for determining whether or not . With the technology used in this embodiment, the SCSI command processing authority can be granted in units of connection partners, and as a result, it is possible to prevent unauthorized SCSI commands from being processed and to improve security. be able to.

Example 2 will be described in detail with reference to the drawings. The first embodiment is an example focusing on a software storage system constructed on an IP network. On the other hand, the system of the present embodiment uses FCoE (Fibre Channel over Ethernet). Hereinafter, the present embodiment will be described mainly focusing on differences from the first embodiment. Also in the description of the present embodiment, the same numbers shown in all the drawings have the same functions, and thus the description thereof is omitted.

FIG. 9 is a block diagram illustrating a functional configuration example of the computer system 20 according to the second embodiment. The computer system 20 includes

hosts

300 and 301, a remote storage 302, a management infrastructure 303, and a software storage instance 304.

The host 300, host 301, remote storage 302, management infrastructure 303, and software storage instance 304 are equivalent to the host 101, remote storage 102, management infrastructure 103, and software storage instance 104 of FIG. Has function.

However, in the second embodiment, it is not connected to the IP network as in the first embodiment, but is connected by FCoE. Therefore, the software storage instance 304 includes an FCoE control unit 310 that performs FCoE protocol processing instead of the IP control unit 112 of FIG. 1A.

Also, the management infrastructure 303 does not have the key information table 134 unlike the management infrastructure 103 of FIG. 1A. This is because FCoE does not implement an encryption function as a protocol. However, when an FCoE switch or the like having an encryption function that is not a standard specification is introduced into the computer system 20, key information equivalent to the key information table 134 of FIG. 1A is stored in the

hosts

300 and 301, the remote storage 302, and the software storage 304. Prepare it. In this case, since it is not necessary to perform key distribution by the management infrastructure 303, in the initial setting of the computer system 20, only steps F1, F2, and F5 need be performed in the flowchart of FIG. There is no need to implement.

FIG. 10 is a diagram illustrating connections between the SCSI access control unit 113 and other units in the second embodiment. In the SCSI access control unit 113 illustrated in FIG. 10, an FCoE control unit 310 is connected to the pair information reception unit 200 instead of the IP control unit 112 in the first embodiment illustrated in FIG. 4.

In this embodiment, unlike the first embodiment, IPsec is not used. Therefore, it is impossible to authenticate the legitimacy of the connection partner in communication using FCoE and to encrypt communication data transmitted to and received from the connection partner.

On the other hand, also in the second embodiment, the SCSI access control unit 113 can provide a function equivalent to that of the first embodiment. Specifically, the SCSI access control unit 113 can grant the authority to use the SCSI command to the connection partner unit. As a result, the software storage instance 304 is not registered as a pair, that is, prohibits connection from the unpaired host 300, and grants the right to use only the I / O command to the paired host 301. It can be said that the storage 302 is authorized to perform only the remote copy control. As a result, it is possible to prevent the software storage instance 304 from processing an illegal SCSI command, and to improve security.

DESCRIPTION OF SYMBOLS 10 ... Computer system, 100 ... Host, 101 ... Host, 102 ... Remote storage, 103 ... Management infrastructure, 104 ... Software storage instance, 104A ... Software storage server, 110 ... Software storage, 111 ... SCSI control part, 112 ... IP control 113: SCSI access control unit, 114 ... Drive group, 120 ... Command control unit, 121 ... Data control unit, 122 ... Drive control unit, 123 ... Command processing unit, 124 ... IPsec processing unit, 125 ... SCSI command control information 130 ... Orchestrator 131 ... Information device management unit 132 ... Storage access management unit 133 ... Configuration information table 134 ... Key information table 135 ... Pair information table 20 ... Computer system 200 ... Pair information reception , 201 ... SCSI command control information generation unit, 201 ... command control information generation unit, 202 ... command buffer size notification unit, 203 ... confirmation request transmission / reception unit, 204 ... confirmation request verification unit, 205 ... SCSI command list, 220 ... network , 300 ... Host, 301 ... Host, 302 ... Remote storage, 303 ... Management infrastructure, 304 ... Software storage instance, 310 ... FCoE control unit, 410 ... CPU, 411 ... CPU core, 420 ... Memory, 431 ... HBA, 432 ... NIC, 451 ... SSD, 452 ... HDD, 460 ... disk device, 900 ... IP network

Claims

Software storage that stores data as storage and connects to a host that uses the data and a remote storage that implements remote copying of the data,
A processor for executing a storage program for processing a storage control command including an I / O command from the host and a remote copy with the remote storage;
A memory for storing the storage program and information for the processor to execute the storage program;
The memory stores in advance command control information that limits a command type of a storage control command that is individually permitted to a host or remote storage connected to the software storage,
When the processor receives a storage control command from the host or the remote storage, the processor refers to the command control information, and whether the received storage control command is a storage control command permitted to the requester of the storage control command. Determining whether or not to execute the storage control command by the storage program when permitted.
calculator.
The command control information is information that further limits a command size permitted for each command type permitted for the host or the remote storage,
The processor sets the size of a buffer that holds a storage control command to be processed based on the command size in the command control information, and when the storage control command is received from the host or the remote storage, the storage control command If the size can be stored in the buffer, the storage control command stored in the buffer is referred to the command control information, and the storage control command stored in the buffer is a command type permitted to the storage control command request source. The storage control command is executed by the storage program,
The computer according to claim 1.
The memory previously holds command list information that defines a command size for each command type,
The processor obtains pair information indicating a host or remote storage connected as a pair with the software storage and a command type executable for each host or remote storage from a management device that manages a system configuration. , Generating the command control information based on the pair information and the command list information,
The computer according to claim 2.
The processor acquires, from the management device, an encryption key for encrypting communication with the host or the remote storage, and uses the encryption key for encryption of communication with the host or the remote storage. Item 4. The computer according to item 3.
When the processor executes the storage program, the software storage, a command processing unit that controls whether or not the processing by the software storage is permitted for the storage control command, and the command processing unit includes the storage An access control unit that manages the command control information for determining whether or not to permit processing for the control command is constructed;
The access control unit
A pair information receiving unit for receiving the pair information from the management device;
A command control information generating unit that generates the command control information based on the pair information and the command list information;
A command buffer size notifying unit for notifying the command processing unit of a command buffer size that is a size of a buffer that temporarily holds the storage control command determined based on a command size defined in the command control information;
A confirmation request transmission / reception unit that transmits / receives a control signal of inquiry processing as to whether or not to allow processing of a storage control command from the command processing unit;
A confirmation request verification unit that determines whether or not to permit processing for a storage control command for which confirmation is requested by a control signal transmitted and received by the confirmation request transmission / reception unit;
The computer according to claim 3.
Software storage for storing data as storage and connecting to a host that uses the data and a remote storage that implements remote copy of the data, including I / O commands from the host and remote copy to the remote storage A processor that executes a storage program for processing a storage control command; and a memory that stores information for the processor to execute the storage program, wherein the memory is a host or a remote connected to the software storage Command control information that limits the command type of the storage control command that is individually permitted to the storage and the command size that is permitted is stored in advance, and the processor stores the host or the remote When a storage control command is received from storage, the command control information is referred to, and it is determined whether or not the received storage control command is a storage control command permitted to the requester of the storage control command. Software storage for executing the storage control command by the storage program;
A management device for managing the system configuration,
The software storage is a host or remote storage in which the memory previously holds command list information in which a command size is defined for each command type, and the processor is connected to the software storage in pairs from the management device Generating pair information indicating a command type of a storage control command that can be executed for each of the hosts or the remote storage, and generating the command control information based on the pair information and the command list information.
Computer system.
The processor acquires, from the management device, an encryption key for encrypting communication with the host or the remote storage, and uses the encryption key for encryption of communication with the host or the remote storage. Item 7. The computer system according to Item 6.
Storage including data as storage, host using the data and remote storage for realizing remote copy of the data, including I / O commands from the host and remote copy with the remote storage A processor that executes a storage program for processing a control command; and a memory that stores information for the processor to execute the storage program. The memory is connected to a host or a remote storage connected to the storage. In a computer that stores in advance command control information that limits the command types that are individually permitted for each, a program that is executed by the processor,
In the processor,
When a storage control command is received from the host or the remote storage, a procedure for referring to the command control information;
For determining whether or not the storage control command is a storage control command permitted to the requester of the storage control command, and executing the storage control command by the storage program when permitted Program.
The command control information is information that further limits a command size permitted for each command type of a storage control command permitted for the host or the remote storage,
In the processor,
When a storage control command is received from the host or the remote storage, the command control information is referred to, and the received storage control command is a command type permitted to the requester of the storage control command and a permitted command size. Whether or not
A procedure for executing the storage control command by the storage program when both are permitted,
The program according to claim 8.
The memory previously holds command list information that defines a command size for each command type,
In the processor,
From a management device that manages the system configuration, a host or remote storage connected as a pair with the software storage and a pair information indicating a command type that can be executed for each of the host or the remote storage are obtained,
Generating the command control information based on the pair information and the command list information;
The program according to claim 9.
In the processor,
From the management device, an encryption key for encrypting communication with the host or the remote storage is acquired,
The encryption key is used for encryption of communication with the host or the remote storage.
The program according to claim 10.