Method, system, program, and data structure for maintaining access for security enablement

Abstract

A method of maintaining access for security enablement, wherein, in response to a determination by the host port that, when the host port is enabled for security, it is unable to successfully complete authentication or security association negotiation with a storage port, the host port determines whether an audit mode indicator is enabled in a login response from the storage port, and, based on the determination, preserves input / output (I / O) access to the storage port.

Description

[Technical field]

[0001] The present invention relates generally to maintaining access for security enablement in a host system. [Background technology]

[0002] Fibre Channel refers to a set of unified architectural standards for data transmission developed by the American National Standards Institute (ANSI). Security solutions for the Fibre Channel architecture are provided by the Fibre Channel Security Protocol (FC-SP), also developed by ANSI. FC-SP provides mechanisms for device authentication, per-message security, and policy distribution in a Fibre Channel environment. Further details of FC-SP are provided in the publication "Fibre Channel Security Protocol-2 (FC-SP-2)", Revision 2.72, published by ANSI on June 12, 2012.

[0003] FC-LS-4 provides mechanisms for link services in Fibre Channel and further details are provided in the ANSI publication "Fibre Channel Link Services (FC-LS-4)", Revision 4.04, published on July 16, 2019. FC-FS-5 provides mechanisms for framing and signaling in Fibre Channel and further details are provided in the ANSI publication "Fibre Channel Framing and Signaling-5 (FC-FS-5)", Revision 1.0, published on April 3, 2018.

[0004] In a Fibre Channel environment, to provide secure and encrypted communication between nodes in the fabric, security association (SA) management transactions occur between SA_Initiators and SA_Responders using a security establishment protocol. Initiators and responders may also include ports on the adapters of devices in the Fibre Channel network. Separate security associations are established for data transmission and data reception on the ports. When an SA establishment transaction is completed, it results in a set of security associations and associated keying material that are used to encrypt / decrypt data communication between the initiator and responder under the established security association. An example of a security association protocol is the security association management protocol in FC-SP-2. The protocol consists of a pair of messages, SA_Init and SA_Init Response, to establish a parent association, followed by a pair of messages, SA_Auth and SA_Auth Response, to establish security associations that perform authentication of the entities and protect data transferred between them.

[0005] A storage controller may control access to storage for one or more host computing devices connected to the storage controller via a Fibre Channel network. A storage management application running on the storage controller may manage multiple storage devices, such as disk drives, tape drives, flash drives, and direct access storage devices (DASDs), coupled to the storage controller. The host computing devices may send input / output (I / O) commands to the storage controller, which may execute the I / O commands to read data from or write data to the storage devices. Communication between the host and the storage controller occurs through Fibre Channel ports located on the host-to-storage controller adapters.

[0006] US Patent Publication No. 2010-0154053 discusses a storage security mechanism using cryptographic splitting. US Patent Publication No. 2019-0251282 discusses a cyber security mechanism for transferring data between servers. US Patent Publication No. 2016-0139845 discusses storage level access control for data grouping structures. US Patent Publication No. 2016-0378691 discusses a mechanism for protecting storage against attacks. US Patent No. 8,275,950 discusses a Fibre Channel attached storage controller that may manage one-to-one correspondence of host computer and storage controller ports using a login request control table to maintain enhanced security by blocking any unauthorized access attempts from a host computer on a port-by-port basis. US Patent No. 6,219,771 discusses a data storage device with improved security process and split allocation capabilities. U.S. Patent Application Publication No. 2004-0107342 discusses a secure network file access control system. European Patent Application No. EP1276034A2 discusses security for logical units in a storage subsystem. U.S. Patent Application Publication No. 2016-0342798 discusses a system and method for secured device management. U.S. Patent No. 8,799,436 discusses a system and method for auditing and verifying configuration items in an information technology (IT) configuration management database. Summary of the Invention

[0007] A method, system, and computer program product are provided in which a host port is enabled for security. In response to a determination by the host port that it is unable to successfully complete an authentication or security association negotiation with a storage port, the host port determines whether an audit mode indicator is enabled in a login response from the storage port. The host port preserves input / output (I / O) access to the storage port based on a determination of whether the audit mode indicator is enabled in the login response from the storage port. As a result, the host port may be able to perform I / O through the storage port even if it is unable to successfully complete an authentication or security association negotiation with the storage port.

[0008] In a further embodiment, the host port performs I / O to the storage port in response to determining that the audit mode indicator is enabled in the login response from the storage port. As a result, the host port performs I / O through the storage port even if the host port is unable to successfully complete an authentication or security association negotiation with the storage port when the audit mode indicator is enabled.

[0009] In an additional embodiment, the host port avoids performing I / O to the storage port in response to determining that the audit mode indicator is not enabled in the login response from the storage port. As a result, the host port is unable to successfully complete an authentication or security association negotiation with the storage port and will not perform I / O through the storage port when the audit mode indicator is not enabled.

[0010] In an additional embodiment, the host port returns the I / O request to the operating system of the host computing device in response to determining that the audit mode indicator is not enabled in the login response from the storage port. As a result, if it is not possible to successfully complete authentication or security association negotiation with the storage port and the audit mode indicator is not enabled, an alternative mechanism is attempted for performing the I / O.

[0011] In a further embodiment, the host port determines that it is unable to successfully complete authentication or security association negotiation with the storage port if the host port is unable to contact a key server to obtain a certificate to authenticate with the storage port, and may take further action to determine the state of the audit mode indicator to determine whether I / O requests should be sent to the storage port.

[0012] In an additional embodiment, the host port determines that it is not possible to successfully complete authentication or security association negotiation with the storage port if there is a failure in the process for authentication or security association negotiation with the storage port, and may take further action to determine the state of the audit mode indicator to determine whether an I / O request should be sent to the storage port.

[0013] In a further embodiment, the audit mode indicator is enabled in the program implementing the Fibre Channel link service via an indication in auxiliary parameter data word 0, bit 23. Consequently, enhancements are made to Fibre Channel to increase operation based on the security bits provided by Fibre Channel.

[0014] Reference is now made to the drawings, in which like reference numerals represent corresponding parts throughout the several views. [Brief description of the drawings]

[0015] [Figure 1] 1 illustrates a block diagram of a heterogeneous computing environment including multiple hosts communicating with multiple storage controllers and / or storage devices via a Fibre Channel fabric, according to some embodiments. [Diagram 2] 1 is a block diagram illustration of a system for maintaining access for hosts for security enablement in a heterogeneous computing environment, according to some embodiments. [Diagram 3] 1 illustrates a block diagram showing security bits for login in Fibre Channel and enforcement to Fibre Channel via an audit mode indicator, according to some embodiments. [Figure 4] 1 is an illustration of a block diagram showing login and response in Fibre Channel according to some embodiments. [Diagram 5] 1 is a block diagram illustrating an enhancement to Fibre Channel that provides indications for "security enforcement" and "security enablement" via enabling or disabling of an audit mode indicator, according to some embodiments. [Figure 6] 1 is an illustration of a flow chart showing operation of a security-enforced storage port according to some embodiments. [Figure 7] 1 is an illustration of a flow chart showing operation of a security-enabled storage port according to some embodiments. [Figure 8] 1 is a block diagram illustrating conditions that prevent authentication and management of security associations from being completed successfully, according to some embodiments. [Figure 9]1 is an illustration of a block diagram showing multiple host ports logging into a single storage port, according to some embodiments. [Figure 10] 1 illustrates a flowchart showing operations in a storage device for determining whether to change a storage port to a security enforcement state, according to some embodiments. [Figure 11] 1 is an illustration of a flowchart showing operations for maintaining access for security enablement in a host system, according to some embodiments. [Figure 12] 13 is an illustration of a flowchart showing additional operations for maintaining access for security enablement in a host system, according to some embodiments. [Figure 13] 1 is an illustration of a flowchart showing operations for maintaining access for security enablement in a storage device, according to some embodiments. [Figure 14] 11 is an illustration of a flowchart showing additional operations for maintaining access for security enablement in a storage device, according to some embodiments. [Figure 15] 1 is a block diagram illustration of a cloud computing environment according to some embodiments. [Figure 16] 16 is a block diagram illustration of further details of the cloud computing environment of FIG. 15, according to some embodiments. [Figure 17] FIG. 17 illustrates a block diagram of a computing system showing some elements included in the hosts, storage controllers and storage devices described in FIGS. 1-16, according to some embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] In the following description, reference is made to the accompanying drawings which form a part hereof, and which illustrate several embodiments, It is to be understood that other embodiments may be utilized and structural and operational changes may be made.

[0017] The standard for encrypting Fibre Channel links (FC-SP-2) includes a protocol for mutual authentication of two endpoints (i.e., ports) and for negotiation of an encryption key to be used in a communications session between those two endpoints. The standard provides support for a variety of mechanisms for authenticating the parties involved and by which keying material is provided or developed.

[0018] In the FC-SP-2 standard, support for authentication within an endpoint is indicated by the setting of the security bit in the common service parameters sent to the peer during a login session. When set to a value of 1 in a login request, the security bit indicates that the sending port can perform authentication. If the responding port sets the security bit to 1 in the reply when it accepts a login request, this indicates that the responding port requires that authentication be performed at this time before granting any further access to the sender of the login.

[0019] The FC-SP-2 standard specifies the behavior of the responding endpoint by accepting or rejecting the login request and setting the security bit based on the security policy in effect at that endpoint at the time the request is received. The standard has no specification as to how this policy is instantiated at the responding endpoint. In an enterprise data center, care must be taken to protect access to data and to provide security for that data. When enabling security in a heterogeneous environment that includes some systems and storage ports that do not support security (e.g., legacy ports), some embodiments provide mechanisms to ensure that connectivity is not lost, in contrast to current standards that do not allow such mechanisms to be provided.

[0020] Some embodiments provide a mechanism for enabling security at the host as an "audit mode" where the host does not lose access to data when security is enabled at the storage device. An indication is provided via the setting of an audit mode indicator at the time of login that allows the host port to continue to access the storage port after security is enabled. Once authentication and security enablement are confirmed to be successfully completed, security enablement changes to a policy of security enforcement. Security enablement means that I / O can be performed even if authentication and security enablement are not successfully completed, whereas security enforcement means that I / O cannot be performed unless authentication and security enablement are successfully completed. While in audit mode, the host may provide tools to continually access the storage device and audit the security state of the connection.

[0021] Some embodiments provide a mechanism for a host to determine that it is unable to successfully complete authentication and / or security association with a storage device and to check whether security is not being enforced on the storage port using an audit mode indicator. If the audit mode indicator is set, the host processor continues to send I / O operations to the storage device along the selected port. If the audit mode indicator is not set, the host processor stops the I / O operations to the storage device and notifies the host application or operating system to find an alternate path to complete the I / O operations.

[0022] Additionally, with Fibre Channel, many host ports can log into a single storage port (as described in FC-FS-5). Of these host ports, some may support security and some may not. If the port setting is set to security enforcement, the host ports that do not support security can lose access to the storage port because they are not allowed to log in.

[0023] In some embodiments, the storage device provides information to indicate the current number of logins to each of its ports. For the number of logins, the storage device provides the number of security capable logins and the number of logins that have been successfully authenticated and security enabled. From this information, it is determined whether a loss of access to the port may occur if the configuration of the storage port is changed to security-enforced. Once all logins are determined to be secure, the configuration is changed without loss of access because all host ports can successfully enable security. In some embodiments, when it is desired to change the configuration to security-enforced, the storage device checks the login counter to determine whether a loss of access may occur (i.e., whether there are logins that are not successfully authenticated) and prevents the configuration from being changed to security-enforced.

[0024] Some embodiments provide a storage port that supports setting to enable security without enforcement and provides auditable statistics (e.g., login count, security capable login count, and security enabled login count) to determine the effects of setting security to enforcement. An audit mode indicator is set in the login response to the host port to indicate that I / O can be sent to this storage port even if authentication cannot be successfully completed. Setting for security enabled or enforced can be performed at the storage array or on an individual storage port basis.

[0025] In some embodiments, a setting is provided for security enforcement with automated checking of login indicators to prevent setting changes where loss of access may occur. An option is also provided to force a change to security enforcement without considering the login indicators.

[0026] As a result, the evolution towards Fibre Channel-based connectivity will require improvements to devices to maintain connectivity in order to perform I / O.

[0027] Exemplary embodiments 1 illustrates a block diagram 100 of a heterogeneous computing environment that includes multiple hosts 102, 104 that communicate with multiple storage controllers and / or storage devices 108, 110 via a Fibre Channel fabric 106 according to some embodiments. Both the storage controllers and storage devices are indicated by reference numerals 108, 110, and the hosts 102, 104 may communicate with a storage controller that controls the storage devices or may communicate with the storage devices without involving any storage controller. A storage controller may also be considered an advanced type of storage device because it controls and allows access to one or more storage devices.

[0028] The hosts 102, 104 and storage controllers 108, 110 may include any suitable computing device, including personal computers, workstations, servers, mainframes, hand-held computers, palm-top computers, telephony devices, network equipment, blade computers, processing devices, controllers, etc. The storage devices may include hard disk drives, tape drives, solid state drives, etc., storage devices currently known in the art.

[0029] The hosts 102, 104 and the storage devices 108, 110 may be elements of any suitable network, such as a storage area network, a wide area network, the Internet, an intranet, etc. In some embodiments, the hosts 102, 104 and the storage devices 108, 110 may be elements of a cloud computing environment. The connection between the hosts 102, 104 and the storage devices 108, 110 in the network and / or cloud computing environment may be via a Fibre Channel fabric 106.

[0030] A host may also include one or more host ports. For example, host 102 includes multiple host ports 112, and host 104 includes multiple host ports 114. A storage device may also include multiple storage ports. For example, storage device 108 includes multiple storage ports 116, and storage device 110 includes multiple storage ports 118. The host ports 112, 114 and the storage ports 116, 118 may communicate over the Fibre Channel fabric 106.

[0031] In some embodiments, not all hosts support security for host ports. For example, some legacy hosts may not support security for Fibre Channel host ports, or some legacy adapters in hosts may not support security for Fibre Channel host ports. For example, host 102 is shown as supporting security for host ports and host 104 is shown as not supporting security for host ports.

[0032] In some embodiments, some storage devices may allow one or more storage ports to be configured as security-enabled with enforcement (i.e., I / O cannot occur from the host port to the storage port unless a secure connection is established between the host port and the storage port). In some embodiments, some storage devices may allow one or more storage ports to be configured as security-enabled without enforcement (i.e., I / O can occur from the host port to the storage port even if a secure connection is not established between the host port and the storage port). For example, storage device 108 may have at least one of storage ports 116 enabled with security with enforcement (other storage ports in storage device 108 may have security enabled without enforcement). In FIG. 1, storage device 110 may have at least one of storage ports 118 enabled with security without enforcement (other storage ports in storage device 110 may have security enabled with enforcement).

[0033] Thus, FIG. 1 illustrates some embodiments that allow I / O operations to be sent from a host port to a storage port even when it is not possible to successfully complete an authentication or security association negotiation between the host port and the storage port.

[0034] FIG. 2 illustrates a block diagram 200 of a system for maintaining access to a host 202 for security enablement in a heterogeneous computing environment according to some embodiments.

[0035] A host 202 is communicatively coupled to multiple storage devices 204, 206 via a Fibre Channel fabric 208. Storage device 204 has storage port 210 of storage device 204 enabled with security enforcement, and storage device 206 has storage port 212 of storage device 206 enabled with security without enforcement. In some embodiments, a storage port can be changed from security enabled without enforcement to security enabled with enforcement, or vice versa.

[0036] Host 202 includes host port 214, which communicates with storage ports 210, 212. In the embodiment shown in FIG. 2, host port 214 can send I / O to storage port 212 even if it is unable to successfully complete authentication or security association negotiation between host port 214 and storage port 212 because storage port 212 has security enabled without enforcement. However, host port 214 cannot send I / O to storage port 210 if it is unable to successfully complete authentication or security association negotiation between host port 214 and storage port 210 because storage port 210 has security enabled with enforcement.

[0037] If the host port 214 is unable to send the I / O operation to the storage port, the operating system 216 of the host 202 attempts to send the I / O operation through another mechanism.

[0038] 3 illustrates a block diagram 300 showing security bits 302 for login in current Fibre Channel standards and enforcement to Fibre Channel via an audit mode indicator 304, according to some embodiments. The audit mode indicator 304 can be enabled (reference numeral 306) or not enabled (reference numeral 308).

[0039] It should be noted that audit mode indicator 304 is not found in existing Fibre Channel standards. Enabling audit mode indicator 304 allows for the enabling of security without enforcement, working in concert with the configuration of security bit 302.

[0040] In some embodiments, the audit mode indicator 304 is enabled via an indication in auxiliary parameters data word 0, bit 23 in a program implementing Fibre Channel Link Service (FC-LS-4). In other embodiments, other mechanisms for implementing the audit mode indicator 304 may be provided. The audit mode indicator 304 and security bit 302 may be part of one or more data structures used to perform the operations.

[0041] 4 illustrates a block diagram 400 showing a login and response in Fibre Channel, according to some embodiments. A host port 402 sends a login request 404 to a storage port 406. The host port 402 is also referred to as the "sending port" and the storage port 406 is also referred to as the "receiving port."

[0042] In a login request 404 from host port 402, the security bit 302 is set to 1 to indicate that the sending port (i.e., host port 402) is capable of performing authentication.

[0043] Upon receiving login request 404, storage port 406 sends a response 408 to host port 402. The response 408 from storage port 406 may set security bit 302 to 1 to indicate that the receiving port (i.e., storage port 406) requires that authentication be performed now before granting any further access to the sending port (i.e., host port 402).

[0044] In some embodiments, even if security bit 302 is set to 1 in the response, if audit mode indicator 304 is enabled (set) to indicate security enabled without enforcement, the requirement to complete authentication before granting any further access is disabled.

[0045] FIG. 5 illustrates a block diagram 500 showing enhancements to Fibre Channel that provide indications for “security enforcement” and “security enablement” via enabling or disabling of audit mode indicator 304, according to some embodiments.

[0046] The indication is provided by a receiving port (e.g., a storage port in a storage device) in response to a login request from a host port (as shown by reference numeral 502). The indication may be provided via the setting of the audit mode indicator 304. Setting the audit mode indicator 304 as enabled may result in a storage port state of "security enabled" 504, meaning that security is enabled without enforcement. Setting the audit mode indicator 304 as not enabled may result in a storage port state of "security enforcement" 506, meaning that security is enabled with enforcement.

[0047] FIG. 6 illustrates a flow chart 600 showing the operation of a storage port with security in place, according to some embodiments. Control passes to block 604 where authentication and management of security associations is initiated between the host port and the storage port. Control passes to block 606 where a determination is made as to whether the authentication and management of security associations is successfully completed between the host port and the storage port. If it is completed ("yes" branch 608), control passes to block 610 where the host port is allowed to begin performing I / O through the storage port (at block 610). If it is not completed ("no" branch 612), control passes to block 614 where the host port is prevented from performing I / O through the storage port.

[0048] FIG. 7 illustrates a flow chart 700 showing operation of a security-enabled storage port according to some embodiments.

[0049] Control begins at block 702, where security is enabled for the storage port. Control proceeds to block 704, where authentication and security association management between the host port and the storage port is initiated. The host port is allowed to perform I / O through the storage port (block 706), regardless of whether the authentication and security association management operations have or have not completed successfully (at block 708). The time at which I / O is allowed to begin may vary in different embodiments.

[0050] FIG. 8 illustrates a block diagram 800 showing conditions that prevent successful completion of authentication and management of security associations, according to some embodiments.

[0051] The first condition 802 is an incomplete configuration of the security policy that may prevent successful completion of the authentication and security association management. The second condition 804 includes an inaccessible key server that provides credentials to access the storage device that may prevent successful completion of the authentication and security association management. The third condition 806 is a failure of the authentication and security association management exchange that may prevent successful completion of the authentication and security association management. All of these conditions may prevent successful completion of the authentication and security association management in the operations shown in Figures 6 and 7.

[0052] 9 illustrates a block diagram 900 showing multiple host ports 902, 904, 906 logging into a single storage port 908 according to some embodiments. The single storage port 908 is contained within a storage device or storage controller 910, which may have other storage ports.

[0053] In FIG. 9, host ports 902 and 906 support security, while host port 904 does not support security, possibly because it is contained in a legacy adapter or host, or for other reasons including configuration by an administrator.

[0054] The storage device or storage controller 910 maintains statistics (reference number 912) regarding login characteristics referred to as login counters and login indicators. The statistics include the number of current logins to the storage port (reference number 914), the number of security-enabled logins to the storage port (reference number 916), and the number of security-enabled logins to the storage port (reference number 918). A security-enabled login is one that has been successfully authenticated and has security enabled.

[0055] In some embodiments, the statistics regarding login counters and login characteristics 912 are used by the storage device or storage controller 910 to determine the effect on I / O access by the host when the security enforcement mode is set. In additional embodiments, the statistics regarding login counters and login characteristics 912 are used by the storage device or storage controller to prevent switching from a security enabled mode to a security enforcement mode if switching to the security enforcement mode would result in a loss of I / O access by the host.

[0056] In a further embodiment, the storage device or storage controller 910 provides an option 920 to force a switch to a security enforcement mode without considering statistics 912 regarding login counters and login characteristics.

[0057] FIG. 10 illustrates a flowchart 1000 showing operations in a storage device to determine whether a storage port should be changed to a security enforcing state according to some embodiments.

[0058] Control begins at block 1002 where the storage device determines that multiple host ports have performed logins to a storage port of the storage device. Control proceeds to block 1004 where the storage device maintains statistics regarding login counters and login characteristics. The storage device determines (at block 1006) from the login counters and login characteristics whether any host ports would lose I / O access to the storage device if the storage port configuration were changed to security-enforced. If so ("yes" branch 1008), then not all host port logins are secure (i.e., not all host ports will be successfully authenticated), and control proceeds to block 1010 where the storage port configuration is prevented from being changed to security-enforced.

[0059] If, in block 1006, the storage device determines from the login counter and login characteristics that none of the host ports will lose I / O access to the storage device if the storage port settings are changed to security enforced ("No" branch 1012), then all host port logins are secure (i.e., all host ports are successfully authenticated) and control proceeds to block 1014, where the storage port settings are allowed to be changed to security enforced.

[0060] FIG. 11 illustrates a flowchart 1100 showing operations for maintaining access for security enablement in a host system according to some embodiments.

[0061] Control begins at block 1102 where a host port is enabled for security. The host port determines (at block 1104) that it is unable to successfully complete an authentication or security association negotiation with the storage port.

[0062] In response to the host port determining that it is unable to successfully complete an authentication or security association negotiation with the storage port, the host port determines whether an audit mode indicator is enabled in the login response from the storage port (at block 1106). The host port reserves input / output (I / O) access to the storage port based on determining whether the audit mode indicator is enabled in the login response from the storage port. As a result, the host port may be able to perform I / O through the storage port even if it is unable to successfully complete an authentication or security association negotiation with the storage port.

[0063] In response to determining that the audit mode indicator is enabled in the login response from the storage port ("yes" branch 1108), the host port performs I / O to the storage port (at block 1110). Performing I / O to the storage port means sending an I / O operation to the storage port to perform an I / O operation in which data is read, written, or accessed. As a result, the host port performs I / O through the storage port even if it is unable to successfully complete authentication or security association negotiation with the storage port when the audit mode indicator is enabled.

[0064] In response to determining that the audit mode indicator is not enabled in the login response from the storage port ("no" branch 1112), the host port avoids performing I / O to the storage port (at block 1114). Consequently, if it is not possible to successfully complete an authentication or security association negotiation with the storage port and the audit mode indicator is not enabled, the host port will not perform I / O through the storage port. From block 1114, control passes to block 1116, where the host port returns the I / O request to the operating system of the host computing device. Consequently, if it is not possible to successfully complete an authentication or security association negotiation with the storage port and the audit mode indicator is not enabled, an alternative mechanism is attempted to perform I / O.

[0065] FIG. 12 illustrates a flowchart 1200 showing additional operations for maintaining access for security enablement in a host system according to some embodiments.

[0066] If the host port cannot contact the key server to obtain a certificate to authenticate with the storage port, the host port determines (at block 1202) that it is unable to successfully complete authentication or security association negotiation with the storage port. As a result, the host port may take further action to determine the state of the audit mode indicator to determine whether an I / O request should be sent to the storage port.

[0067] From block 1202, control passes to block 1204, which depicts the host port determining that it is unable to successfully complete authentication or security association negotiation with the storage port if there is a failure in the process for authentication or security association negotiation with the storage port. As a result, the host port may take further action to determine the state of the audit mode indicator to determine whether an I / O request should be sent to the storage port.

[0068] FIG. 13 illustrates a flowchart 1300 showing operations for maintaining access for security enablement in a storage device according to some embodiments.

[0069] Control begins at block 1302, where a storage port receives a login request. From block 1302, control may proceed to block 1304 or block 1306.

[0070] In block 1304, the storage port sets an audit mode indicator to an enabled state in the login response to the host port to enter a security enabled mode to instruct the host port that input / output (I / O) operations should be sent from the host port to the storage port even if it is unable to successfully complete authentication or security association negotiation with the storage device. As a result, an insecure host may perform I / O to the storage device.

[0071] In block 1306, the storage port sets the audit mode indicator to a non-enabled state in the login response to the host port to enter security enforcement mode to instruct the host port that I / O operations should not be sent from the host port to the storage port if it is unable to successfully complete authentication or security association negotiation with the storage device. As a result, an insecure host cannot perform I / O to the storage device.

[0072] FIG. 14 illustrates a flowchart 1400 showing additional operations for maintaining access for security enablement in a storage device.

[0073] Control begins at block 1402 where a storage controller including a storage port maintains statistics regarding login counters and login characteristics, including the current number of logins to the storage port, the number of security-enabled logins to the storage port, and the number of security-enabled logins to the storage port. Accordingly, in some embodiments, the statistics regarding the login counters and login characteristics are used by the storage controller to determine the effect on I / O access by a host when a security enforcement mode is set.

[0074] In a further embodiment, the login counters and statistics regarding login characteristics are used by the storage controller to prevent a switch from the security enabled mode to the security enforcing mode if a switch to the security enforcing mode would result in a loss of I / O access by the host (at block 1404). As a result, a switch to the security enforcing mode is prevented if the host would lose I / O access.

[0075] In some embodiments, the storage controller provides an option to force a switch to security-enabled mode without considering statistics regarding login counters and login characteristics.

[0076] In some embodiments, the storage controller sets at least one storage port of the plurality of storage ports to a security enforcing mode, and the storage controller sets at least one other storage port of the plurality of storage ports to a security enabling mode, such that enabling of the audit mode indicator is on a per port basis.

[0077] In a further embodiment, the storage port is included in a storage controller including a first storage array and a second storage array, where the security enforcement mode is set for the first storage array and the security enablement mode is set for the second storage array, and thus enabling of the audit mode indicator is done on a per storage array basis.

[0078] 1-14 thus illustrate some embodiments that enforce or do not enforce security based on the setting of the audit mode indicator to augment operation based on the setting of the security bit in the Fibre Channel. As a result, legacy devices can continue to perform I / O in a heterogeneous computing environment even when the security bit is enabled in the Fibre Channel.

[0079] Cloud Computing Environment Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or interaction with a service provider.

[0080] 15, an exemplary cloud computing environment 50 is shown. Security enforcement or security enablement (indicated by reference numeral 52) is performed in the cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof, may communicate. The nodes 10 may also communicate with each other. The nodes may be grouped, physically or virtually, in one or more networks, such as a private, community, public, or hybrid cloud, or combinations thereof, as described herein above (not shown). This enables the cloud computing environment 50 to provide infrastructure, platform, or software, or combinations thereof, as a service, without the cloud consumer having to maintain resources on the local computing device. It should be understood that the types of computing devices 54A-N shown in FIG. 15 are intended to be exemplary only, and that the computing nodes 10 and cloud computing environment 50 can communicate with any type of computerized device via any type of network and / or addressable network connections (e.g., using a web browser).

[0081] Referring now to Figure 16, there is shown a set of functional abstraction layers provided by cloud computing environment 50 (Figure 15). It should be understood that the components, layers, and functions shown in Figure 16 are intended to be merely exemplary, and that embodiments of the present invention are not limited thereto.

[0082] The hardware and software layer 60 includes hardware components and software components. Examples of hardware components include mainframes, such as IBM's ZSERIES* systems, RISC (reduced instruction set computer) architecture based servers, such as IBM's PSERIES* systems, IBM's XSERIES* systems, IBM's BLADECENTER* systems, storage devices, networks, and networking components. Examples of software components include network application server software, such as IBM's WEBSPHERE* application server software, and database software, such as IBM's DB2* database software.

[0083] The virtualization layer 62 provides an abstraction layer from which examples of virtual entities may be provided, such as virtual servers, virtual storage, virtual networks including virtual private networks, virtual applications and operating systems, and virtual clients.

[0084] In one example, the management layer 64 may provide the functions described below. Resource provisioning provides dynamic procurement of computing and other resources used to execute tasks within the cloud computing environment. Metering and pricing provides cost tracking as resources are utilized within the cloud computing environment and charging or billing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. A user portal provides access to the cloud computing environment for consumers and system administrators. Service level management provides allocation and management of cloud computing resources such that required service levels are achieved. Service level agreement (SLA) planning and fulfillment provides proactive coordination and procurement of anticipated future needs for cloud computing resources according to SLAs.

[0085] The workload layer 66 provides examples of functions for which cloud computing environments are utilized. Examples of workloads and functions provided from this layer include mapping and navigation, software development and lifecycle management, virtual classroom instructional delivery, data analytics processing, transaction processing, and security enforcement or enablement 68 as shown in Figures 1-15.

[0086] Additional embodiment details The described operations may be implemented as a method, apparatus, or computer program product using standard programming and / or engineering techniques to effect software, firmware, hardware, or any combination thereof. Accordingly, aspects of the embodiments may take the form of entirely hardware embodiments, entirely software embodiments (including firmware, resident software, microcode, etc.), or embodiments combining software and hardware aspects, all generally referred to herein as "circuits," "modules," or "systems." Additionally, aspects of the embodiments may take the form of a computer program product. The computer program product may also include one or more computer-readable storage media having computer-readable program instructions for causing a processor to perform aspects of the embodiments of the present invention.

[0087] A computer readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer readable storage media includes the following: portable computer diskettes, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), static random access memories (SRAM), portable compact disk read-only memories (CD-ROM), digital versatile disks (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves on which instructions are recorded, and any suitable combination of the above. As used herein, a computer-readable storage medium should not be construed as a transitory signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or an electrical signal transmitted through wires.

[0088] The computer readable program instructions described herein may be downloaded from a computer readable storage medium into each computing / processing device or may be downloaded to an external computer or storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer readable program instructions from the network and transfers the computer readable program instructions to a computer readable storage medium within the respective computing / processing device for storage.

[0089] The computer readable program instructions for carrying out the operations of the embodiments of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, or source or object code written in any combination of one or more programming languages, including object oriented programming languages ​​such as Smalltalk®, C++, or similar, and traditional procedural programming languages ​​such as the “C” programming language or similar. The computer readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or remote server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer readable program instructions by using state information of the computer readable program instructions to individually configure the electronic circuitry to perform aspects of embodiments of the present invention.

[0090] Aspects of embodiments of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0091] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to cause a machine to create means for implementing the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams, and these computer readable program instructions may be stored in a computer readable storage medium capable of instructing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer readable storage medium on which the instructions are stored constitutes an article of manufacture containing instructions that implement aspects of the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0092] Also, the computer readable program instructions may be loaded into a computer, other programmable data processing apparatus, or other device such that the instructions, which execute on the computer, other programmable apparatus, or other device, implement the functions / operations identified in one or more blocks of the flowcharts and / or block diagrams, and a series of operational steps may be executed on the computer, other programmable apparatus, or other device to produce a computer-implemented process.

[0093] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions described in the blocks may occur in a different order than the order described in the drawings. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may sometimes be executed in the reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of multiple blocks in the block diagrams and / or flowchart illustrations, may be implemented by a dedicated hardware-based system that executes the specified functions or actions or executes a combination of dedicated hardware and computer instructions.

[0094] FIG. 17 illustrates a block diagram showing some elements that may be included in a computing device, host, storage controller, storage device, or other device shown in FIGS. 1-16, according to some embodiments. The system 1700 may also include circuitry 1702, which may include at least a processor 1704 in some embodiments. The system 1700 may also include memory 1706 (e.g., a volatile memory device) and storage 1708. The storage 1708 may also include a non-volatile memory device (e.g., EEPROM, ROM, RPOM, flash, firmware, programmable logic, etc.), a magnetic disk drive, an optical disk drive, a tape drive, etc. The storage 1708 may include an internal storage device, an attached storage device, or a network accessible storage device, or a combination thereof. The system 1700 may include program logic 1710, which includes code 1712 that is loaded into the memory 1706 and executed by the processor 1704 or the circuitry 1702. In some embodiments, program logic 1710 including code 1712 may be stored in storage 1708. In some other embodiments, program logic 1710 may be implemented in circuitry 1702. One or more of the components in system 1700 may communicate via a bus or other couplings or connections 1714. Thus, although FIG. 17 shows program logic 1710 separate from other elements, program logic 1710 may be implemented in memory 1706 or circuitry 1702 or both.

[0095] Some embodiments may be directed to methods for deploying computing instructions, either by a human or by an automated process of incorporating computer readable code into a computing system, where the code, in combination with the computing system, is capable of performing the operations of the described embodiments.

[0096] Terms such as "an embodiment," "an embodiment," "some embodiments," "the embodiment," "the embodiments," "one or more embodiments," "some embodiments," and "one embodiment" mean "one or more, but not necessarily all, embodiments of the invention," unless otherwise specified.

[0097] The terms "including," "comprising," "having," and variations thereof mean "including, but not limited to," unless expressly stated otherwise.

[0098] An enumerated listing of items does not imply that any or all of the items are mutually exclusive, unless specifically stated.

[0099] The terms "a," "an," and "the" mean "one or more," unless otherwise specified.

[0100] Devices that are in communication with each other need not be in continuous communication with each other unless specified otherwise. Further, devices that are in communication with each other may communicate directly or indirectly through one or more intermediaries.

[0101] Describing an embodiment having several components in communication with each other does not imply that all such components are required, but rather, various components that are optional are described to illustrate the wide variety of possible embodiments of the present invention.

[0102] Additionally, although process steps, method steps, algorithms, or the like may be described in a sequential order, such processes, methods, and algorithms may be configured to function in other orders. In other words, any sequence or order of steps described does not necessarily indicate that the steps must be performed in that order. Steps of processes described herein may be performed in any order that is practical. Additionally, some steps may be performed simultaneously.

[0103] It will be readily apparent that where a single device or product is described herein, multiple devices / products (whether or not they cooperate) may be used rather than a single device / product. Similarly, it will be readily apparent that where multiple devices or products are described herein (whether or not they cooperate) a single device / product may be used rather than multiple devices or products, or a different number of devices / products may be used rather than the number of devices or programs shown. The functionality and / or features of a device may instead be realized by one or more other devices not explicitly described as having such functionality / features. Thus, it is not necessary for other embodiments of the invention to include the device itself.

[0104] At least some of the operations that may be illustrated in the figures show some events occurring in a particular order. In alternative embodiments, some operations may be performed in a different order, modified, or removed. Also, steps may be added to the logic described above while still being in accordance with the described embodiment. Furthermore, operations described herein may occur sequentially, or some operations may be processed in parallel. Still further, operations may be performed by a single processing device, or may be performed by multiple distributed processing devices.

[0105] The above description of various embodiments of the invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in accordance with the above teachings. It is intended that the scope of the invention be limited not by this detailed description, but rather by the claims appended hereto. The above details, examples and data provide a complete description of the manufacture and use of the composition of the invention. Since many embodiments of the invention can be made without departing from the scope of the invention, the invention resides in the claims appended hereto.

Claims

1. Enabling a host port for security; and determining, by the host port, whether an audit mode indicator is enabled in a login response from the storage port in response to the host port determining that it is unable to successfully complete an authentication or security association negotiation with the storage port; determining whether the audit mode indicator is enabled in the login response from the storage port, and if enabled, performing I / O to the storage port through the host port, and if not enabled, avoiding performing I / O to the storage port through the host port; The method includes:

2. 2. The method of claim 1, further comprising, in response to determining that the audit mode indicator is not enabled in the login response from the storage port, returning an I / O request by the host port to an operating system of a host computing device.

3. 2. The method of claim 1, wherein if the host port is unable to access a key server to obtain a certificate to authenticate with the storage port, the host port determines that it is unable to successfully complete authentication or security association negotiation with the storage port.

4. 4. The method of claim 3, wherein the host port determines that authentication or security association negotiation with a storage port cannot be successfully completed if there is a failure in a process for the authentication or security association negotiation with the storage port.

5. 2. The method of claim 1, wherein the audit mode indicator is enabled via an indication in ancillary parameters data word 0, bit 23 in a program implementing a Fibre Channel link service.

6. Memory, A processor, coupled to the memory, for performing operations, the operations including: Enabling a host port for security; and determining, by the host port, whether an audit mode indicator is enabled in a login response from the storage port in response to the host port determining that it is unable to successfully complete an authentication or security association negotiation with the storage port; determining whether the audit mode indicator is enabled in the login response from the storage port, and if enabled, performing I / O to the storage port through the host port, and if not enabled, avoiding performing I / O to the storage port through the host port; the processor, A system comprising:

7. The operation includes:

7. The system of claim 6, further comprising, in response to determining that the audit mode indicator is not enabled in the login response from the storage port, returning an I / O request by the host port to an operating system of a host computing device.

8. 7. The system of claim 6, wherein if the host port is unable to access a key server to obtain a certificate to authenticate with the storage port, the host port determines that it is unable to successfully complete authentication or security association negotiation with the storage port.

9. 9. The system of claim 8, wherein the host port determines that authentication or security association negotiation with a storage port cannot be successfully completed if there is a failure in a process for the authentication or security association negotiation with the storage port.

10. 7. The system of claim 6, wherein the audit mode indicator is enabled via an indication in auxiliary parameters data word 0, bit 23 in a program implementing a Fibre Channel link service.

11. A computer program causing a computer to execute the method according to any one of claims 1 to 5.

12. A computer readable storage medium having the computer program according to claim 11 stored therein.

Images