Ethernet Storage Node Isolation Using Zone-Based ACL Switching

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing Ethernet storage systems face security risks due to unauthorized access between zones, as nodes outside a zone can manually establish links for unauthorized access, compromising data security.

Innovation Solution

Implementing a node isolation method using access control list (ACL) rules based on zone membership, allowing only packets that match the ACL to be permitted, thereby blocking unauthorized traffic between different zones and ensuring secure communication within the same zone.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If zoning technology is used to enable communication within zones, then nodes in the same zone can access each other, but nodes outside the zone can manually establish links for unauthorized access

Engineering Contradiction:

Improvecommunication accessibilityVSAvoiddata security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The network is segmented into multiple zones using ACL rules that are dynamically generated based on zone information. Each zone has its own access control policies, allowing legitimate communication within zones while preventing unauthorized access from outside zones. The switching device divides network traffic handling into permitted and denied segments based on zone membership.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The switching device acts as an intermediary between zones, dynamically generating and enforcing ACL rules based on zone information received from network zoning devices. This intermediary function ensures that only authorized traffic passes between zones while maintaining communication efficiency within zones.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If ACL rules are generated for all node pairs in a zone, then security isolation is achieved, but ACL rule resources are consumed excessively

Engineering Contradiction:

Improvesecurity isolationVSAvoidACL rule resources

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

Multiple ACL rules are merged into a single comprehensive ACL rule that covers all node pairs within a zone. The switching device generates one ACL rule per zone rather than one rule per node pair, significantly reducing ACL rule resource consumption while maintaining the same security isolation effect for all nodes in that zone.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The generated ACL rules are designed to be universal for all nodes within a zone, allowing a single ACL rule to serve multiple node pairs simultaneously. This multi-functional approach enables the ACL rule to permit or deny traffic for any node combination within the zone without requiring separate rules for each pair.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12531832B2Node isolation method, switching device, and ethernet storage system

Publication Date: 2026.01.20 HUAWEI TECH CO LTD

AI summary

A node isolation method, a switching device, and an Ethernet storage system implement node isolation between zones in the Ethernet storage system. A first switching device in the Ethernet storage system determines a first access control list ACL rule between a first node and a second node, where the first switching device is an access device of the first node, the first node and the second node are located in the Ethernet storage system, and the first node and the second node correspond to a first zone; and if a packet whose source is the first node or a packet whose destination is the first node matches the first ACL rule, forwards the packet.