Method and device for realizing access control

Abstract

The invention discloses a method and a device for realizing access control. The method comprises the following steps of: setting a shielding rule for the access authority of logical units aiming at a port of an initiator of a host; setting local logical unit numbers for the logical units, and establishing the mapping relationship between the local logical unit numbers and access logical unit numbers by combining the existing access logical unit numbers of the logical units; and according to the mapping relationship established for the logical unit numbers, accessing the logical units by using the set shielding rule through the an initiating port of the host. By adopting the method and the device of the invention, the access authority still can be limited and the access control is realized based on the access authority under the condition that a special hardware facility or special solidified application software does not need to be added in a network, so that the method and the device reduce management overhead without causing additional network burden; and because the settings of shielding and mapping have flexibility, the flexibility of the change of user requirements can be met, the work efficiency of a system is increased, and user satisfaction is improved.

Description

technical field [0001] The present invention relates to computer technology, in particular to a method and device for realizing access control. Background technique [0002] Current storage systems usually exist in the form of distributed systems and adopt a client / server model. A storage system consists of three major parts: client, server, and service delivery subsystem. The above-mentioned client is also called a Small Computer System Interface (SCSI) initiator (Small Computer System Interface, SCSI) initiator, and the above-mentioned server is also called a SCSI target. Among them, the client can initiate a request, the server can process the request, and the service transmission subsystem can connect the client and the server, and transmit the request and response between the client and the server. The interface between the client and the service delivery subsystem is called the SCSI initiator port, and the interface between the server and the service delivery subsyst...

AI Technical Summary

Problems solved by technology

[0004] In the currently applied storage system, it is usually necessary to restrict the access authority of the host Initiator port (this port belongs to the SCSI class) to the logical unit (LU) in the storage system, such as: adding dedicated hardware facilities in the network to access This will significantly increase the burden on the network in terms of topology maintenance and device management; or, restrict access rights in the form of adding professional and solidified application software to the network, which will significantly increase the operating costs of the network. And cannot achieve flexible management of access rights

It can be seen that the current access restriction method will cause an additional network burden during the access process, resulting in an increase in management overhead, and is not conducive to improving user satisfaction

Images