Storage Access Control via Path Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer systems where a single logical volume is shared among multiple host apparatuses, existing access restriction technologies fail to securely manage reservations, leading to reduced security and reliability, as the first storage apparatus incorrectly grants access to other host apparatuses via a second storage apparatus used for reservations.
Innovation Solution
A computer system and access restriction method where the second storage apparatus transmits specific commands to the first storage apparatus containing registration-target and reservation keys, along with path information, to ensure that only the host apparatus that made the reservation can access the logical volume, by comparing these keys and path information for authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access restriction technology is implemented where a host apparatus pre-reserves a logical volume in a storage apparatus, then simultaneous access by multiple host apparatuses is prevented, but security and reliability are reduced because the storage apparatus cannot distinguish between the reserving host and other hosts accessing via different paths
Solution Approach 1:
The patent introduces path information as an intermediary identifier that bridges the reserving host apparatus and the storage apparatus. This path information is transmitted through the second storage apparatus and stored in the first storage apparatus, enabling the storage apparatus to verify not just that a reservation exists but that the accessing host is the same one that made the reservation. This resolves the security vulnerability where any host could access reserved volumes through different paths.
Solution Approach 2:
The patent implements preliminary transmission and storage of path information during the reservation phase. Before actual data access occurs, the path information identifying the specific access route is captured and stored in association with the reservation. This preliminary action ensures that when access requests come in, the storage apparatus can immediately verify the path match without delay, preventing unauthorized access while maintaining efficient operation.
2Productivity
If a logical volume is shared among multiple host apparatuses through virtualization, then resource utilization is improved, but access control security deteriorates because the storage apparatus cannot identify which host is authorized to access
Solution Approach 1:
In the virtualized environment, the patent uses path information as an intermediary that travels through the virtualization layer (second storage apparatus) to the physical storage (first storage apparatus). This allows the system to maintain shared access for multiple hosts while still enforcing individual host authorization through path verification, resolving the contradiction between resource sharing and security.
Solution Approach 2:
The patent segments the access control mechanism into two parts: the virtualization layer that handles resource allocation and sharing, and the storage layer that handles security verification through path information. This segmentation allows each layer to perform its specialized function without compromising the other, enabling both high resource utilization and strong access control.
Data Source
AI summary
A computer system and an access restriction method may be used to enable security and improve reliability. The computer system includes a first storage apparatus and a second storage apparatus. The first storage apparatus provides a first logical volume from/to which a host apparatus reads and writes data, and the second storage apparatus provides a virtual second logical volume obtained by virtualizing the first logical volume of the first storage apparatus to the host apparatus. The first path information relates to a path from the host apparatus to the second logical volume registered in the first storage apparatus in association with the first logical volume of the first storage apparatus. Reservation of and access to the first logical volume is granted only for a reservation request and access request with matching path information from the host apparatus.