NVMe Name Server Zoning for Fabric Security and Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In enterprise class data centers using NVMe over Fabrics, the transmission of irrelevant NVMe subsystem qualified names (NQNs) can lead to security challenges and delay connection establishment between hosts and NVMe storage domains, as these unnecessary NQNs are sent to hosts, causing unnecessary communication and delaying the connection setup.
Innovation Solution
Implementing NVMe subsystem NQN-based zoning, where the NVMe Name Server (NNS) masks out irrelevant NQNs, allowing only designated hosts to access specific NVMe storage domains by using async notifications to update the NVMe storage domain's map table, thereby bypassing the discovery phase and directly establishing connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If NVMe subsystem NQNs are transmitted to all hosts in the fabric, then hosts can discover available storage domains, but irrelevant NQNs are sent to hosts causing unnecessary communication and delaying connection establishment
Solution Approach 1:
The NVMe Name Server performs preliminary zoning actions by maintaining a map table that pre-determines which hosts can access which NVMe storage domains. This preliminary classification allows the system to skip the discovery phase and directly establish connections, eliminating the time waste from transmitting and filtering irrelevant NQNs at runtime.
Solution Approach 2:
The patent extracts and removes irrelevant NQNs from the communication flow by using the pre-established zoning map. Instead of transmitting all possible NQNs to all hosts, the system extracts only the relevant NQNs based on the zoning information, eliminating unnecessary communication overhead.
2Loss of information
If all NVMe subsystem NQNs are transmitted to hosts, then complete information is provided for discovery, but security challenges arise due to exposure of irrelevant NQNs to unauthorized hosts
Solution Approach 1:
The patent applies local quality by providing different sets of NQN information to different hosts based on their authorized access rights. Each host receives only the NQNs relevant to its designated NVMe storage domains, rather than a universal set of all NQNs. This localized information distribution maintains security while providing complete information for each host's specific needs.
Solution Approach 2:
The NVMe Name Server performs preliminary security classification by maintaining a zoning map that determines which hosts can access which storage domains before any NQN transmission occurs. This pre-established authorization framework ensures that only relevant and authorized NQNs are communicated to each host, eliminating security vulnerabilities from the outset.
3Measurement precision
If NVMe Name Server maintains detailed zoning information in a map table, then precise host-to-storage domain mapping is achieved, but system complexity increases
Solution Approach 1:
The NVMe Name Server acts as an intermediary that centralizes the maintenance of zoning information in its map table. Rather than requiring each host or NVMe subsystem to independently manage complex zoning logic, the Name Server mediates all zoning-related operations, simplifying the overall system architecture while maintaining precise mapping accuracy.
Solution Approach 2:
The system implements self-service by having the NVMe Name Server automatically manage the zoning map and generate appropriate NQN information for each host without manual intervention. The async notification mechanism allows the system to automatically update hosts when zoning changes occur, reducing operational complexity while maintaining precise mapping.
Data Source
AI summary
In some examples, fabric driven NVMe subsystem zoning may include receiving, from a non-volatile memory express (NVMe) Name Server (NNS), a zoning specification that includes an indication of a host that is to communicate with a given NVMe subsystem of an NVMe storage domain. Based on the zoning specification, the host may be designated as being permitted to connect to the given NVMe subsystem of the NVMe storage domain. An NVMe connect command may be received from the host. Based on the designation and an analysis of the NVMe connect command, a connection may be established between the given NVMe subsystem of the NVMe storage domain and the host.