Enable maintain access for security on the host system

Abstract

The host port is enabled for security. In response to determining by the host port that authentication or security association negotiation with the storage port cannot be successfully completed, the host port determines whether an audit mode indicator has been enabled in a login response from the storage port. Based on determining whether the audit mode indicator has been enabled in the login response from the storage port, the host port maintains input / output I / O access to the storage port.

Description

Technical Field

[0001] The present invention generally relates to enabling maintenance access for security on a host system. Background Art

[0002] Fibre Channel refers to an integrated set of architectural standards for data transmission developed by the American National Standards Institute (ANSI). Security solutions for the Fibre Channel architecture are provided by the Fibre Channel Security Protocol (FC-SP) developed by ANSI. FC-SP provides mechanisms for device authentication, per-message security, policy distribution, etc. in a Fibre Channel environment. Further details of FC-SP are provided in the publication "Fiber Channel Security Protocol-2 (FC-SP-2)" (Revision 2.71) published by ANSI on June 12, 2012.

[0003] FC-LS-4 provides mechanisms for link services in Fibre Channel and further details are provided in the ANSI publication "Fiber Channel Link Services (FC-LS-4)" (Revision 4.04) dated July 16, 2019. FC-FS-5 provides mechanisms for framing and signaling in Fibre Channel and further details are provided in the ANSI publication "Fiber Channel framing and Signaling-5 (FC-FS-5)" (Revision 1.0) dated April 3, 2018.

[0004] In a Fibre Channel environment, in order to provide secure and encrypted communications between nodes in a Fibre Channel architecture, a security association (SA) management transaction is performed between an SA_Initiator and an SA_Responder using a security establishment protocol. The initiator and responder may include ports in an adapter in a device in a Fibre Channel network. Separate security associations are established for data transmission and data reception at the port. Completion of the SA establishment transaction results in a set of security associations and associated key materials, which are used to encrypt / decrypt data communications between the initiator and the responder under the established security association. An example of a security association protocol is the security association management protocol in FC-SP-2. The protocol includes a pair of messages SA_Init and SA_Init Response to establish a parent association, followed by a pair of messages SA_Auth and SA_AuthResponse to perform authentication of entities and establish a security association to protect data transmitted between entities.

[0005] The storage controller can control access to the storage of one or more host computing devices, which can be coupled to the storage controller via a Fibre Channel network. A storage management application executed in the storage controller can manage multiple storage devices coupled to the storage controller, such as disk drives, tape drives, flash drives, direct access storage devices (DASD), etc. The host computing device can send input / output (I / O) commands to the storage controller, and the storage controller can execute the I / O commands to read data from the storage device or write data to the storage device. Communication between the host and the storage controller occurs via Fibre Channel ports on adapters located in the host and the storage controller.

[0006] US Patent Publication 20100154053 discusses a storage security mechanism using password splitting. US Patent Publication 20190251282 discusses a network security mechanism for transmitting data between servers. US Patent Publication 20160139845 discusses storage-level access control for data packet structures. US Patent Publication 20160378691 discusses a mechanism for protecting storage devices from attacks. US Patent 8275950 discusses a fiber channel-attached storage controller that can use a login request control table to manage a one-to-one correspondence of ports of a host computer and a storage controller to prevent any unauthorized access attempts from the host computer on a port-by-port basis, thereby maintaining enhanced security. US Patent 6219771 discusses a data storage device with improved security processing and partition allocation functions. US Patent Publication 20040107342 discusses a secure network file access control system. European Patent Application EP1276034A2 discusses the security of logical units in a storage subsystem. US Patent Publication 20160342798 discusses a system and method for protected device management. US Patent 8,799,436 discusses a system and method for auditing and validating configuration items in an information technology (IT) configuration management database. Summary of the invention

[0007] A method, system, and computer program product are provided, wherein a host port is enabled for security. In response to a determination by the host port that authentication or security association negotiation with a storage port cannot be successfully completed, the host port determines whether an audit mode indicator has been enabled in a login response from the storage port. Based on determining whether the audit mode indicator has been enabled in the login response from the storage port, the host port maintains input / output (I / O) access to the storage port. As a result, the host port is able to perform I / O via the storage port even if authentication or security association negotiation with the storage port cannot be successfully completed.

[0008] In other embodiments, in response to determining that the audit mode indicator is enabled in the login response from the storage port, the host port performs I / O to the storage port. As a result, when the audit mode indicator is enabled, the host port performs I / O via the storage port even if authentication or security association negotiation with the storage port cannot be successfully completed.

[0009] In an additional embodiment, in response to determining that the audit mode indicator has not been enabled in the login response from the storage port, the host port refrains from performing I / O to the storage port. As a result, if authentication or security association negotiation with the storage port cannot be successfully completed and the audit mode indicator has not been enabled, the host port does not perform I / O via the storage port.

[0010] In an additional embodiment, in response to determining that the audit mode indicator has not been enabled in the login response from the storage port, the host port returns the I / O request to the operating system of the host computing device. As a result, if authentication or security association negotiation with the storage port cannot be successfully completed and the audit mode indicator has not been enabled, an alternative mechanism for performing I / O is attempted.

[0011] In other embodiments, if the host port cannot access a key server to obtain credentials for authenticating to the storage port, the host port determines that authentication or security association negotiation with the storage port cannot be successfully completed. As a result, the host port can take further action to determine the state of the audit indicator to determine whether to send an I / O request to the storage port.

[0012] In an additional embodiment, if there is a failure in the process for authentication or security association negotiation with the storage port, the host port determines that the authentication or security association negotiation with the storage port cannot be successfully completed. As a result, the host port can take further action to determine the state of the audit indicator to determine whether to send an I / O request to the storage port.

[0013] In other embodiments, the audit mode indicator is enabled via an indication in an auxiliary parameter data word 0 bit 23 in a program implementing the Fibre Channel link service.As a result, Fibre Channel is enhanced to increase operations based on the security bits provided by Fibre Channel. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Referring now to the drawings, wherein like reference numerals designate corresponding parts throughout:

[0015] Figure 1A block diagram of a heterogeneous computing environment including multiple hosts communicating with multiple storage controllers and / or storage devices via a Fibre Channel fabric is shown according to some embodiments;

[0016] Figure 2 A block diagram of a system for maintaining access of a host for security enablement in a heterogeneous computing environment is shown in accordance with certain embodiments;

[0017] Figure 3 A block diagram illustrating security bits for logging into Fibre Channel and enhancements to Fibre Channel via an audit mode indicator is shown in accordance with certain embodiments;

[0018] Figure 4 shows a block diagram illustrating login and response in Fibre Channel according to some embodiments;

[0019] Figure 5 A block diagram is shown according to certain embodiments, which illustrates enhancements to Fibre Channel to provide indications of "enforce security" and "enable security" via an enabled or disabled audit mode indicator;

[0020] Figure 6 A flow chart illustrating the operation of a storage port that enforces security according to certain embodiments is shown;

[0021] Figure 7 A flow chart illustrating the operation of a security-enabled storage port according to certain embodiments is shown;

[0022] Figure 8 shows a block diagram illustrating conditions that prevent authentication and security association management from successfully completing according to certain embodiments;

[0023] Fig. 9 shows a block diagram illustrating logging into multiple host ports into a single storage port according to certain embodiments;

[0024] Fig.10 A flow chart illustrating operations in a storage device for determining whether to change a storage port to a forced security state is shown according to certain embodiments;

[0025] Fig.11 A flow chart illustrating operations for maintaining access for security enablement on a host system is shown in accordance with certain embodiments;

[0026] Fig.12 A flow chart illustrating additional operations for maintaining access for security enablement on a host system is shown in accordance with certain embodiments;

[0027] Fig.13A flow chart illustrating operations for maintaining access for security enablement in a storage device is shown in accordance with certain embodiments;

[0028] Fig.14 A flow chart illustrating additional operations for maintaining access for security enablement in a storage device is shown according to certain embodiments;

[0029] Fig.15 A block diagram of a cloud computing environment according to some embodiments is shown;

[0030] Fig.16 According to some embodiments, Fig.15 A block diagram of the cloud computing environment with further details; and

[0031] Fig.17 A block diagram of a computing system according to some embodiments is shown, which shows that the computing system may include Figure 1-16 Specific units in the host, storage controller, and storage device described in. DETAILED DESCRIPTION

[0032] In the following description, reference is made to the accompanying drawings which form a part hereof and which illustrate various embodiments. It is understood that other embodiments may be utilized and that structural and operational changes may be made.

[0033] The standard for encrypting Fibre Channel links (FC-SP-2) includes a protocol for mutual authentication of two endpoints (i.e., ports) and a protocol for negotiating encryption keys used in a communication session between the two endpoints. The standard provides support for various mechanisms to authenticate the parties involved and mechanisms to provision or develop key material.

[0034] In the FC-SP-2 standard, support for authentication within an endpoint is indicated by the setting of the security bit of the common service parameters passed to the peer during the login process. When set to a value of 1 in a login request, the security bit indicates that the sending port is able to perform authentication. When a responding port accepts a login request, if the responding port also sets the security bit to 1 in the reply, this indicates that the responding port requires the sender of the login to now perform authentication before granting any further access.

[0035] The FC-SP-2 standard specifies the behavior of a responding endpoint in accepting or rejecting a login request and setting the security bit based on the security policy in effect at the endpoint when the request is received. The standard does not specify how the policy is instantiated at the responding endpoint. In an enterprise data center, attention needs to be paid to protecting access to data as well as providing security for the data. When security is enabled in a heterogeneous environment that includes some systems and storage ports that do not support security (e.g., legacy ports), certain embodiments provide mechanisms to ensure that connectivity is not lost, in contrast to current standards that do not allow for such mechanisms.

[0036] Certain embodiments provide a mechanism for enabling security at the host in an "audit mode" in which host access to data is not lost when security is enabled in a storage device. An indication is provided at logon by setting an audit mode indicator that allows the host port to continue to access the storage port after security is enabled. Once authentication and enabling of the security mechanism are verified to have been successfully completed, enabling security can be changed to enforcing the security policy. Enabling security means that I / O can be performed even if authentication and enabling of the security mechanism are not successfully completed, while enforcing security means that I / O cannot be performed if authentication and enabling of the security mechanism are not successfully completed. While in audit mode, the host can continue to access the storage device, and tools are provided to audit the security status of the connection.

[0037] Certain embodiments provide a mechanism in which a host determines that an authentication and / or security association with a storage device cannot be successfully completed, and then uses an audit mode indicator to check whether security is not enforced on a storage port. If the audit mode indicator is set, the host processor continues to send I / O operations to the storage device along the selected port. If the audit mode indicator is not set, the host processor stops the I / O operation to the storage device and notifies the host application or operating system to find an alternative path to complete the I / O operation.

[0038] Additionally, in Fibre Channel, many host ports can log in (as described in FC·FS·5) to a single storage port. Some of these host ports may support security and some may not. If the port settings are set to force security, host ports that do not support security may lose access to the storage port because these host ports are not allowed to log in.

[0039] In some embodiments, information is provided by the storage device to show the number of logins currently on each port of the storage device. For the number of logins, the storage device provides the number of logins with security capabilities, and the number of logins that are successfully authenticated and enable security. Based on this information, it can be determined whether access to the port may be lost if the storage port setting is changed to mandatory security. Once it is determined that all logins are safe, the setting can be changed without losing access because all host ports can successfully enable security. In some embodiments, when it is desired to change the setting to mandatory security, the storage device checks the login counter to determine whether access loss may occur (i.e., there is a login that is not successfully authenticated) and prevents the setting from being changed to mandatory security.

[0040] Certain embodiments provide a storage port that supports enabling security without a mandatory setting and provides auditable statistics (e.g., login counts, security-capable login counts, and security-enabled login counts) to determine the impact of setting security to mandatory. An audit mode indicator is set in a login response to a host port, indicating that I / O can be sent to the storage port even if authentication cannot be successfully completed. The enabling or mandatory setting of security can be performed on a storage array or on an individual storage port basis.

[0041] In some embodiments, a setting for mandatory security is provided, which has an automatic check for a login indicator to prevent the setting from being changed in the event of a possible loss of access. An option to force the setting to mandatory security regardless of the login indicator is also provided.

[0042] As a result, in the enhancement of Fibre Channel based connectivity environments, improvements have been made to devices to maintain connectivity for performing I / O.

[0043] Exemplary Embodiments

[0044] Figure 1 A block diagram 100 of a heterogeneous computing environment is shown according to some embodiments, the heterogeneous computing environment including multiple hosts 102, 104 communicating with multiple storage controllers and / or storage devices 108, 110 via a Fibre Channel fabric 106. The storage controllers and storage devices are both shown by reference numerals 108, 110, and the hosts 102, 104 may communicate with a storage controller that controls the storage devices, or may communicate with the storage devices without involving any storage controller. A storage controller may also be considered a high-level type of storage device because it controls and allows one or more hosts to access one or more storage devices.

[0045] Hosts 102, 104 and storage controllers 108, 110 may include any suitable computing devices, including those currently known in the art, such as personal computers, workstations, servers, mainframes, handheld computers, palmtop computers, telephone devices, network devices, blade computers, processing devices, controllers, etc. Storage devices may include storage devices currently known in the art, such as hard disk drives, tape drives, solid-state drives, etc.

[0046] The hosts 102, 104 and the storage devices 108, 110 may be elements in any suitable network (e.g., a storage area network, a wide area network, the Internet, an intranet). In some embodiments, the hosts 102, 104 and the storage devices 108, 110 may be elements in a cloud computing environment. The connection between the hosts 102, 104 and the storage devices 108, 110 in the network and / or cloud computing environment may be through a Fibre Channel fabric 106.

[0047] The host may include one or more host ports. For example, host 102 includes multiple host ports 112, and host 104 includes multiple host ports 114. The storage device may include multiple storage ports. For example, storage device 108 includes multiple storage ports 116, and storage device 110 includes multiple storage ports 118. Host ports 112, 114 and storage ports 116, 118 may communicate via Fibre Channel fabric 106.

[0048] In some embodiments, not all hosts support security of host ports. For example, some legacy hosts may not support security of host ports in Fibre Channel, or some legacy adapters in the hosts may not support security of host ports in Fibre Channel. For example, host 102 is shown as supporting security of host ports, while host 104 is shown as not supporting security of host ports.

[0049] In certain embodiments, certain storage devices may enable one or more storage ports to be configured to have security enabled with enforcement (i.e., I / O may not occur from a host port to a storage port unless a secure connection has been verified as being completed between the host port and the storage port). In certain embodiments, certain storage devices may enable one or more storage ports to be configured to have security not enabled without enforcement (i.e., I / O may occur from a host port to a storage port even if a secure connection has not been verified as being completed between the host port and the storage port). For example, the storage device 108 may have security enabled with enforcement for at least one of the storage ports 116 (other storage ports in the storage device 108 may have security enabled without enforcement). Figure 1, the storage device 110 may have enabled security without enforcement for at least one of the storage ports 118 (other storage ports in the storage device 110 may have enabled security with enforcement).

[0050] therefore, Figure 1 Certain embodiments are shown that allow I / O operations to be sent from a host port to a storage port even if authentication or security association negotiation between the host port and the storage port cannot be successfully completed.

[0051] Figure 2 A block diagram 200 of a system for maintaining access of a host 202 for security enablement in a heterogeneous computing environment is shown in accordance with certain embodiments.

[0052] The host 202 is communicatively coupled to a plurality of storage devices 204, 206 via a Fibre Channel fabric 208. The storage device 204 has security enabled with enforcement for a storage port 210 of the storage device 204, and the storage device 206 has security enabled without enforcement for a storage port 212 of the storage device 206. In some embodiments, a storage port may be changed from enabling security without enforcement to enabling security with enforcement, or vice versa.

[0053] The host 202 includes a host port 214, wherein the host port 214 communicates with the storage ports 210, 212. Figure 2 In the illustrated embodiment, even if the authentication or security association negotiation between the host port 214 and the storage port 212 cannot be successfully completed, the host port 214 can still send I / O to the storage port 212 because the storage port 212 has security enabled without enforcement. However, if the authentication or security association negotiation between the host port 214 and the storage port 210 cannot be successfully completed, the host port 214 cannot send I / O to the storage port 210 because the storage port 210 has security enabled with enforcement.

[0054] In the event that the host port 214 is unable to send an I / O operation to the storage port, the operating system 216 of the host 202 attempts to send the I / O operation via another mechanism.

[0055] Figure 3 A block diagram 300 is shown according to some embodiments, illustrating security bits 302 for logging in the current Fibre Channel standard and enhancements to Fibre Channel via an audit mode indicator 304. The audit mode indicator 304 may be enabled (reference numeral 306) or not enabled (reference numeral 308).

[0056] It should be noted that the audit mode indicator 304 is not found in existing Fibre Channel standards. The enabling of the audit mode indicator 304 allows for enabling security without enforcement to work in conjunction with the configuration of the security bit 302.

[0057] In some embodiments, the audit mode indicator 304 is enabled via an indication in the auxiliary parameter data word 0 bit 23 in a program implementing the Fibre Channel Link Service (FC-LS-4). In other embodiments, other mechanisms may be provided for implementing the audit mode indicator 304. The audit mode indicator 304 and the security bit 302 may be part of one or more data structures used to perform operations.

[0058] Figure 4 A block diagram 400 illustrating logins and responses in Fibre Channel is shown according to some embodiments. A host port 402 sends a login request 404 to a storage port 406. The host port 402 is also referred to as a "sending port" and the storage port 406 is also referred to as a "receiving port."

[0059] In the login request 404 from the host port 402, the security bit 302 is set to 1 to indicate that the sending port (ie, the host port 402) is capable of performing authentication.

[0060] Upon receiving the login request 404, the storage port 406 sends a response 408 to the host port 402. The response 408 from the storage port 406 may set the security bit 302 to 1 to indicate that the receiving port (i.e., the storage port 406) requires the sending port (i.e., the host port 402) to now perform authentication before granting any further access.

[0061] In some embodiments, even if security bit 302 is set to 1 in a response, if audit mode indicator 304 is enabled (ie, set) to indicate that security is enabled without enforcement, the requirement to complete authentication before any further access is granted is overridden.

[0062] Figure 5 A block diagram 500 is shown that illustrates enhancements to Fibre Channel to provide an indication of “security enforced” and “security enabled” via an audit mode indicator 304 that is enabled or not enabled, in accordance with certain embodiments.

[0063] The receiving port (e.g., a storage port in a storage device) provides an indication in a response to a login request issued from the host (as shown via reference numeral 502). The indication may be provided via configuration of an audit mode indicator 304. Configuration of an enabled audit mode indicator 304 may cause the state of the storage port to be changed to "security enabled" 504, which means that security is enabled without enforcement. Configuration of a non-enabled audit mode indicator 304 may cause the state of the storage port to be changed to "security enforced" 506, which means that security is enabled with enforcement.

[0064] Figure 6 A flow chart 600 showing the operation of a storage port that enforces security according to certain embodiments is shown. Control proceeds to block 604, where authentication and security association management is initiated between the host port and the storage port. Control proceeds to block 606, where it is determined whether authentication and security association management have been successfully completed between the host port and the storage port. If so ("yes" branch 608), control proceeds to block 610, where the host port is allowed to begin performing I / O through the storage port (at block 610). If not ("no" branch 612), control proceeds to block 614, where the host port is blocked from performing I / O through the storage port.

[0065] Figure 7 A flow chart 700 illustrating the operation of a security-enabled storage port is shown in accordance with certain embodiments.

[0066] Control begins at block 702, where security is enabled for the storage port. Control proceeds to block 704, where authentication and security association management is initiated between the host port and the storage port. The host port is allowed to perform I / O through the storage port (block 706), regardless of whether the authentication and security association management operation is successful or unsuccessful (at block 708). In different embodiments, the time to begin allowing I / O may be different.

[0067] Figure 8 A block diagram 800 is shown illustrating conditions that prevent authentication and security association management from successfully completing, in accordance with certain embodiments.

[0068] The first condition 802 is an incomplete configuration of a security policy, which may prevent authentication and security association management from being successfully completed. The second condition 804 includes an inaccessible key server that provides credentials for accessing the storage device, which may prevent authentication and security association management from being successfully completed. The third condition 806 is a failure in an authentication and security association management exchange, which may prevent authentication and security association management from being successfully completed. All of these conditions may result in authentication and security association management failing. Figure 6 and 7 The indicated operation could not be completed successfully.

[0069] Fig. 9 A block diagram 900 is shown showing multiple host ports 902, 904, 906 logging into a single storage port 908, in accordance with certain embodiments. The single storage port 908 may be included in a storage device or storage controller 910, which may have other storage ports.

[0070] exist Fig. 9 In FIG. 1 , host ports 902 and 906 support security, while host port 904 does not support security because host port 904 may be included in a legacy adapter or a legacy host, or for some other reason (including configuration by an administrator).

[0071] The storage device or storage controller 910 maintains statistics about login counters and login characteristics, which are referred to as login indicators (reference numeral 912). The statistics include: the number of current logins to the storage port (reference numeral 914); the number of security-capable login counts to the storage port (reference numeral 916); and the number of security-enabled login counts to the storage port (reference numeral 918). Security-enabled logins are those that have been successfully authenticated and have security enabled.

[0072] In some embodiments, if the forced security mode is configured, the statistics 912 about the login counter and login characteristics are used by the storage device or storage controller 910 to determine the impact on the host's I / O access. In additional embodiments, the statistics 912 about the login counter and login characteristics are used by the storage device or storage controller to prevent switching from the enabled security mode to the forced security mode if the host would lose I / O access if switching to the forced security mode.

[0073] In further embodiments, the storage device or storage controller 910 provides an option 920 for forcibly switching to a mandatory security mode without regard to the statistics 912 regarding login counters and login characteristics.

[0074] Fig.10 A flow chart 1000 is shown illustrating operations in a storage device for determining whether to change a storage port to a forced security state, according to some embodiments.

[0075] Control begins at block 1002, where the storage device determines that multiple host ports have performed logins to the storage port of the storage device. Control proceeds to block 1004, where the storage device maintains statistics about the login counter and the login characteristics. If the setting of the storage port is changed to mandatory security, the storage device determines (at block 1006) whether any host port will lose access to the I / O of the storage device based on the login counter and the login characteristics. If so ("yes" branch 1008), not all host port logins are secure (i.e., not all host ports are successfully authenticated), and control proceeds to block 1010, where the setting that blocks the storage port is changed to mandatory security.

[0076] If in box 1006, the storage device determines based on the login counter and login characteristics that no host port will lose access to the I / O of the storage device if the setting of the storage port is changed to enforced security ("No" branch 1012), then all host port logins are secure (i.e., all host ports are successfully authenticated) and control passes to box 1014, where the setting of the storage port is allowed to be changed to enforced security.

[0077] Fig.11 A flow diagram 1100 is shown illustrating operations for maintaining access for security enablement on a host system in accordance with certain embodiments.

[0078] Control begins at block 1102 where a host port is enabled for security. The host port determines (at block 1104) that authentication or security association negotiation with the storage port could not be successfully completed.

[0079] In response to the host port determining that authentication or security association negotiation with the storage port cannot be successfully completed, the host port determines (at block 1106) whether an audit mode indicator has been enabled in a login response from the storage port. The host port maintains input / output (I / O) access to the storage port based on determining whether the audit mode indicator has been enabled in the login response from the storage port. As a result, the host port is able to perform I / O via the storage port even if authentication or security association negotiation with the storage port cannot be successfully completed.

[0080] In response to determining that the audit mode indicator has been enabled in the login response from the storage port ("yes" branch 1108), the host port performs (at block 1110) I / O to the storage port. Performing I / O to the storage port means sending an I / O operation to the storage port to perform the I / O operation, wherein data is read or written or accessed. As a result, when the audit mode indicator has been enabled, the host port performs I / O via the storage port even if authentication or security association negotiation with the storage port cannot be successfully completed.

[0081] In response to determining that the audit mode indicator is not enabled in the login response from the storage port ("no" branch 1112), the host port refrains (at block 1114) from performing I / O to the storage port. As a result, if authentication or security association negotiation with the storage port cannot be successfully completed and the audit mode indicator has not been enabled, the host port does not perform I / O via the storage port. Control proceeds from block 1114 to block 1116, where the host port returns the I / O request to the operating system of the host computing device. As a result, if authentication or security association negotiation with the storage port cannot be successfully completed and the audit mode indicator has not been enabled, an alternative mechanism for performing I / O is attempted.

[0082] Fig.12 A flow chart 1200 is shown illustrating additional operations for maintaining access for security enablement on a host system, in accordance with certain embodiments.

[0083] If the host port cannot access the key server to obtain credentials for authenticating to the storage port, the host port determines (at block 1202) that the authentication or security association negotiation with the storage port cannot be successfully completed. As a result, the host port may take further action to determine the state of the audit indicator to determine whether to send an I / O request to the storage port.

[0084] Control proceeds from block 1202 to block 1204 where the host port determines that the authentication or security association negotiation with the storage port cannot be successfully completed if there is a failure in the process for authentication or security association negotiation with the storage port. As a result, the host port may take further action to determine the state of the audit indicator to determine whether to send an I / O request to the storage port.

[0085] Fig.13 A flow chart 1300 illustrating operations for maintaining access for security enablement in a storage device is shown in accordance with certain embodiments.

[0086] Control begins at block 1302 where a storage port receives a login request. Control may proceed from block 1302 to block 1304 or block 1306.

[0087] In block 1304, the storage port configures the audit mode indicator to be enabled in a login response to the host port to enter a security enabled mode to indicate to the host port that input / output (I / O) operations will be sent from the host port to the storage port even if authentication or security association negotiation with the storage port cannot be successfully completed. As a result, an unsecured host can perform I / O to the storage device.

[0088] In block 1306, if the authentication or security association negotiation with the storage port cannot be successfully completed, the storage port configures the audit mode indicator to be not enabled in the login response to the host port to enter the mandatory security mode to indicate to the host port that I / O operations will not be sent from the host port to the storage port. As a result, the unsecured host cannot perform I / O to the storage device.

[0089] Fig.14 A flow chart 1400 is shown for additional operations for maintaining access for security enablement in a storage device.

[0090] Control begins at block 1402, and a storage controller including a storage port maintains statistics about login counters and login characteristics, the statistics including: the number of current logins to the storage port; the number of security-capable login counts to the storage port; and the number of security-enabled login counts to the storage port. As a result, in some embodiments, if a security enforcement mode is configured, the statistics about the login counters and login characteristics are used by the storage controller to determine the impact on I / O access to the host.

[0091] In an additional embodiment, if the host would lose I / O access when switching to the forced security mode, the statistics about the login counter and the login characteristics are used by the storage controller to prevent (at block 1404) switching from the enabled security mode to the forced security mode. As a result, if the host would lose I / O access, the switch to the forced security mode is prevented.

[0092] In certain embodiments, the storage controller provides an option to force a switch to an enforced security mode without regard to statistics regarding login counters and login characteristics.

[0093] In some embodiments, the storage controller configures at least one storage port of the plurality of storage ports to a forced security mode. The storage controller configures at least another storage port of the plurality of storage ports to an enabled security mode. Thus, the enabling of the audit mode indicator is on a per-port basis.

[0094] In another embodiment, the storage port is included in a storage controller, the storage controller includes a first storage array and a second storage array, wherein the forced security mode is configured for the first storage array, and wherein the enabled security mode is configured for the second storage array. Thus, the enabling of the audit mode indicator is based on each storage array.

[0095] therefore, Figure 1-14Certain embodiments are shown that enforce or do not enforce security based on the configuration of the audit mode indicator to enhance operation based on the configuration of the security bits in the Fibre Channel. As a result, legacy devices can continue I / O in a heterogeneous computing environment even when the security bits are enabled in the Fibre Channel.

[0096] Cloud computing environment

[0097] Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (eg, networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

[0098] Reference now Fig.15 , depicts an illustrative cloud computing environment 50. Security enforcement or enabling is performed in the cloud computing environment 50 (shown via reference numeral 52). As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which a local computing device used by a cloud consumer can communicate, such as a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automobile computer system 54N. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as a private cloud, community cloud, public cloud, or hybrid cloud, or a combination thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service for which the cloud consumer does not need to maintain resources on a local computing device. It should be understood that Fig.15 The types of computing devices 54A-N shown in are intended to be illustrative only, and computing node 10 and cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or network addressable connection (eg, using a web browser).

[0099] Reference now Fig.16 , showing the cloud computing environment 50 ( Fig.15 ) provides a set of functional abstraction layers. It should be understood in advance that Fig.16 The components, layers, and functions shown in are intended to be illustrative only, and embodiments of the present invention are not limited thereto.

[0100] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframes, in one example, IBM ZSERIES* systems; servers based on RISC (Reduced Instruction Set Computer) architecture, in one example, IBM PSERIES* systems; IBM XSERIES* systems; IBM BLADECENTER* systems; storage devices; network and networking components. Examples of software components include network application server software, in one example, IBM WEBSPHERE* application server software; and database software, in one example, IBM DB2* database software.

[0101] Virtualization layer 62 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers; virtual storage; virtual networks, including virtual private networks; virtual applications and operating systems; and virtual clients.

[0102] In one example, the management layer 64 may provide the functionality described below. Resource provisioning provides dynamic procurement of computing resources and other resources used to perform tasks within a cloud computing environment. Metering and pricing provides cost tracking when utilizing resources in a cloud computing environment, as well as billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. A user portal provides access to the cloud computing environment for consumers and system administrators. Service level management provides cloud computing resource allocation and management so that the required service levels are met. Service level agreement (SLA) planning and fulfillment provides pre-scheduling and procurement of cloud computing resources, where future demand is anticipated based on the SLA.

[0103] The workload layer 66 provides examples of functionality that can take advantage of a cloud computing environment. Examples of workloads and functionality that can be provided from this layer include: mapping and navigation; software development and lifecycle management; virtual classroom education delivery; data analytics processing; transaction processing; and enforcing or enabling security 68, such as Figure 1-15 shown.

[0104] Additional Embodiment Details

[0105] The described operation can be implemented as a method, device or computer program product that uses standard programming and / or engineering techniques to produce software, firmware, hardware or any combination thereof. Therefore, the aspects of the embodiment can take the form of a complete hardware embodiment, a complete software embodiment (including firmware, resident software, microcode, etc.) or an embodiment of a combination of software and hardware, which can be collectively referred to as "circuit", "module" or "system" herein. In addition, the various aspects of the embodiment can take the form of a computer program product. The computer program product may include a computer-readable storage medium (or multiple media) storing computer-readable program instructions thereon, and these computer-readable program instructions are used to cause a processor to perform various aspects of an embodiment of the present invention.

[0106] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punch card or a raised structure in a groove on which instructions are recorded, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be interpreted as a temporary signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0107] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0108] The computer-readable program instructions for performing the operation of the embodiment of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages, such as Java, Smalltalk, C++, etc.) and conventional process programming languages ​​(such as "C" programming language or similar programming languages). The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider through the Internet). In some embodiments, in order to perform the various aspects of the embodiment of the present invention, the electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) can execute the computer-readable program instructions by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit.

[0109] Various aspects of embodiments of the present invention are described herein with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to embodiments of the present invention. It will be understood that each frame of the flowchart and / or block diagram and the combination of frames in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0110] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can guide the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0111] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0112] Flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.In this regard, each frame in the flow chart or block diagram can represent the module, segment or part of instruction, which includes one or more executable instructions for realizing the specified logical function.In some alternative embodiments, the function noted in the frame may not occur in the order noted in the figure.For example, two frames shown continuously can actually be performed substantially simultaneously, or these frames can sometimes be performed in reverse order, depending on the function involved.It will also be noted that the combination of the frames in each frame of the block diagram and / or flow chart illustration and the block diagram and / or flow chart illustration can be realized by a dedicated hardware-based system that performs a specified function or action or performs a combination of special hardware and computer instructions.

[0113] Fig.17 A block diagram is shown according to some embodiments, which shows that a Figure 1-16 1700 may include a specific unit in a computing device, host, storage controller, storage device, or other device shown in . System 1700 may include circuit 1702, which may include at least processor 1704 in some embodiments. System 1700 may also include memory 1706 (e.g., volatile storage device) and storage 1708. Storage 1708 may include non-volatile storage devices (e.g., EEPROM, ROM, PROM, flash memory, firmware, programmable logic, etc.), disk drives, optical drives, tape drives, etc. Storage 1708 may include internal storage devices, attached storage devices, and / or network accessible storage devices. System 1700 may include program logic 1710, which includes code 1712 that can be loaded into memory 1706 and executed by processor 1704 or circuit 1702. In some embodiments, program logic 1710 including code 1712 may be stored in storage 1708. In some other embodiments, program logic 1710 may be implemented in circuit 1702. One or more components in the system 1700 may communicate via a bus or via other couplings or connections 1714. Thus, while Fig.17 Program logic 1710 is shown separate from other elements, but program logic 1710 may be implemented in memory 1706 and / or circuit 1702 .

[0114] Certain embodiments may be directed to a method for deploying computing instructions into a computing system by integrating computer readable code by a human or automated process, wherein the code in conjunction with the computing system is enabled to perform the operations of the described embodiments.

[0115] The terms “embodiment,” “embodiments,” “the embodiment,” “these embodiments,” “one or more embodiments,” “some embodiments,” and “one embodiment” mean “one or more (but not all) embodiments of the invention,” unless expressly stated otherwise.

[0116] The terms "including", "comprising", "having" and variations thereof mean "including but not limited to", unless expressly stated otherwise.

[0117] Unless expressly stated otherwise, the enumerated listing of items does not imply that any or all of the items are mutually exclusive.

[0118] The terms "a", "an" and "the" mean "one or more" unless expressly stated otherwise.

[0119] Unless expressly stated otherwise, devices that are in communication with each other need not be in continuous communication with each other. In addition, devices that are in communication with each other may communicate directly or indirectly through one or more intermediaries.

[0120] The description of an embodiment with several components in communication with each other does not imply that all such components are required. Rather, various optional components are described to illustrate various possible embodiments of the invention.

[0121] In addition, although process steps, method steps, algorithms, etc. may be described in a sequential order, such processes, methods, and algorithms may be configured to work in an alternating order. In other words, any order or sequence of steps that may be described does not necessarily indicate a requirement to perform the steps in that order. The steps of the processes described herein may be performed in any feasible order. In addition, some steps may be performed simultaneously.

[0122] When a single device or product is described herein, it is apparent that more than one device / product (whether or not they collaborate) may be used in place of a single device / product. Similarly, where more than one device or product (whether or not they collaborate) is described herein, it will be readily apparent that a single device / product may be used in place of more than one device or product, or that a different number of devices / products may be used in place of the number of devices or programs shown. The functions and / or features of a device may alternatively be embodied by one or more other devices that are not explicitly described as having such functions / features. Therefore, other embodiments of the present invention need not include the device itself.

[0123] At least some of the operations shown in the accompanying drawings show some events that occur in a particular order. In alternative embodiments, some operations can be performed, modified or removed in different orders. In addition, steps can be added to the above logic and still meet the described embodiments. In addition, the operations described here can occur sequentially, or some operations can be processed in parallel. In addition, the operations can be performed by a single processing unit or by a distributed processing unit.

[0124] For the purpose of illustration and description, the above description of various embodiments of the present invention has been given. It is not exhaustive, nor is it intended to limit the present invention to the precise form disclosed. In light of the above teachings, many modifications and variations are possible. The scope of the present invention is not limited by this detailed description, but by the appended claims. The above description, examples and data provide a complete description of the manufacture and use of the composition of the present invention. Since many embodiments of the present invention can be made without departing from the scope of the present invention, the present invention lies in the appended claims.

Claims

1. A computer-implemented method comprising: Enable host ports for security; In response to determining by the host port that authentication or security association negotiation with a storage port cannot be successfully completed, determining by the host port whether an audit mode indicator is enabled in a login response from the storage port; In response to determining that the audit mode indicator is enabled in the login response from the storage port, performing input / output (I / O) to the storage port by the host port; as well as In response to determining that the audit mode indicator has not been enabled in the login response from the storage port, refraining from performing I / O to the storage port by the host port, returning I / O requests by the host port to an operating system of a host computing device.

2. The method according to claim 1, wherein: The audit mode indicator is enabled via an indication in an auxiliary parameter data word in a program implementing the Fibre Channel link service.

3. A computer-implemented method comprising: Enable host ports for security; In response to determining by the host port that authentication or security association negotiation with a storage port cannot be successfully completed, determining by the host port whether an audit mode indicator is enabled in a login response from the storage port; Based on determining whether the audit mode indicator is enabled in the login response from the storage port, input / output I / O access to the storage port is maintained by the host port, wherein if the host port cannot access a key server to obtain credentials for authenticating to the storage port, the host port determines that authentication or security association negotiation with the storage port cannot be successfully completed.

4. The method according to claim 3, wherein: If there is a failure in a process for authentication or security association negotiation with the storage port, the host port determines that authentication or security association negotiation with the storage port cannot be successfully completed.

5. A computer system comprising: Memory; as well as A processor coupled to the memory, wherein the processor performs operations including: Enable host ports for security; In response to determining by the host port that authentication or security association negotiation with a storage port cannot be successfully completed, determining by the host port whether an audit mode indicator is enabled in a login response from the storage port; In response to determining that the audit mode indicator is enabled in the login response from the storage port, performing input / output (I / O) to the storage port by the host port; and In response to determining that the audit mode indicator has not been enabled in the login response from the storage port, refraining from performing I / O to the storage port by the host port, returning I / O requests by the host port to an operating system of a host computing device.

6. The system according to claim 5, wherein: The audit mode indicator is enabled via an indication in an auxiliary parameter data word in a program implementing the Fibre Channel link service.

7. A computer system comprising: Memory; as well as A processor coupled to the memory, wherein the processor performs operations including: Enable host ports for security; In response to determining by the host port that authentication or security association negotiation with a storage port cannot be successfully completed, determining by the host port whether an audit mode indicator is enabled in a login response from the storage port; Based on determining whether the audit mode indicator is enabled in the login response from the storage port, input / output I / O access to the storage port is maintained by the host port, wherein if the host port cannot access a key server to obtain credentials for authenticating to the storage port, the host port determines that authentication or security association negotiation with the storage port cannot be successfully completed.

8. The system according to claim 7, wherein: If there is a failure in a process for authentication or security association negotiation with the storage port, the host port determines that authentication or security association negotiation with the storage port cannot be successfully completed.

9. A computer program product, the computer program product comprising computer readable program code, the computer readable program code being configured to perform operations, the operations comprising: Enable host ports for security; In response to determining by the host port that authentication or security association negotiation with a storage port cannot be successfully completed, determining by the host port whether an audit mode indicator is enabled in a login response from the storage port; In response to determining that the audit mode indicator is enabled in the login response from the storage port, performing input / output (I / O) to the storage port by the host port; as well as In response to determining that the audit mode indicator has not been enabled in the login response from the storage port, refraining from performing I / O to the storage port by the host port, returning I / O requests by the host port to an operating system of a host computing device.

10. The computer program product according to claim 9, wherein: The audit mode indicator is enabled via an indication in an auxiliary parameter data word in a program implementing the Fibre Channel link service.

11. A computer program product, the computer program product comprising computer readable program code, the computer readable program code being configured to perform operations, the operations comprising: Enable host ports for security; In response to determining by the host port that authentication or security association negotiation with a storage port cannot be successfully completed, determining by the host port whether an audit mode indicator is enabled in a login response from the storage port; Based on determining whether the audit mode indicator is enabled in the login response from the storage port, input / output I / O access to the storage port is maintained by the host port, wherein if the host port cannot access a key server to obtain credentials for authenticating to the storage port, the host port determines that authentication or security association negotiation with the storage port cannot be successfully completed.

12. The computer program product according to claim 11, wherein: If there is a failure in a process for authentication or security association negotiation with the storage port, the host port determines that authentication or security association negotiation with the storage port cannot be successfully completed.

Images