Storage network management system and method

BACKGROUND OF THE INVENTION

00011. Field of the Invention

0002The present invention relates to a system constituted of a storage device connected to a network and a plurality of information processing apparatuses.

00032. Description of the Related Art

0004Attention has been paid recently to network storage technology, IP-SAN (Internet Protocol-Storage Area Network), which uses an IP network whose initial cost is cheaper than that a network using Fibre Channel (hereinafter abbreviated to “FC”). The IP network requires, however, an additional cost for maintaining security because many security threatening crack tools are circulated.

0005As the security countermeasure for a conventional FC-SAN, LUN (Logical Unit Number) masking has been used. The LUN masking is the technique according to which access from a computer to a logical unit (Logical Unit, hereinafter abbreviated to LU) of a storage device is restricted by the storage device to prevent illegal data reference, alteration and erase.

0006If the LUN masking technique of FC-SAN is to be realized in IP-SAN, a computer accessible to each LUN of a storage device is designated by an IP address assigned to the computer. It is, however, easy to tap a packet sent/received to/from another computer connected to the same subnet in the IP network. Therefore, if the same network is shared by two or more departments or businesses, data security is impossible to be ensured, and the configuration of only the LUN masking is insufficient for the security countermeasure. It is therefore necessary to use other security techniques together with the LUN masking.

0007A candidate for the security technique to be used with the LUN masking may be data cryptograph utilizing IPSec techniques or the like. However, a cryptography process has a large load on a CPU. If this process is applied to IP-SAN, the I/O performance of a storage device is degraded. In order to suppress such performance degradation, although the cryptography process may be executed by using dedicated hardware, this approach is unsatisfactory for the security technique to be used together with the LUN masking because it requires a high initial cost.

0008Another candidate for the security technique may be VLAN (Virtual Local Area Network) techniques according to which one physical network is divided into a plurality of logical networks. With the VLAN techniques, one or more computers such as those used by the same department posing no problem of data tapping are classified into one group. Each group is assigned a logical network to prevent data tapping by other groups. VLAN has been adopted by most of LAN switches so that there is no additional initial cost. It can therefore be expected that a combination of LUN masking and VLAN technologies will be used as the security countermeasure of IP-SAN.

0009Techniques of reducing the load of configuring VLAN are disclosed in JP-A-2001-53776.

0010The configuration work of LUN masking and VLAN is required to be performed not only on the side of a storage device but also on the side of switches in IP-SAN. Since the configuration work is required on the sides of different devices, a system user or administrator has a large work load.

0011In the configuration work of LUN masking, a computer is designated by an IP address (or domain name), whereas in the configuration work of VLAN, it is necessary to designate a computer by a port ID for identifying a port of a connection destination switch. Since the configuration works of LUN masking and VLAN designate a computer by using different IDs, a configuration miss is likely to occur.

0012The techniques disclosed in the above-cited JP-A-2001-53776 automatically perform the configuration work of VLAN when a switch to which a computer is connected is changed, and do not solve the above-described problem.

SUMMARY OF THE INVENTION

0013An object of this invention is to provide a system capable of facilitating the configuration of VLAN and LUN masking.

0014According to one embodiment of the invention, a management method for a storage system having a storage device, a switch and a computer respectively connected by a network, comprises a step of, in accordance with an identifier of a storage area of the storage device and a first address of the computer, performing a configuration of an access control to the storage area of the storage device, converting the first address of the computer into a second address, converting the second address of the computer into an identifier of a port of the switch connected to the computer, and adding the identifier of the port to a virtual LAN for the switch.

0015According to the embodiment, as a system administrator configures LUN masking and enters a subnet address of VLAN to which the computer and storage device belong and when the computer or storage device is connected to the network, a storage management device automatically configures VLAN.

0016Other objects, features and advantages of the invention will become apparent from the following description of the embodiments of the invention taken in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

0017<figref idref="DRAWINGS">FIG. 1</figref> is a diagram showing an example of a system configuration according to a first embodiment.

0018<figref idref="DRAWINGS">FIGS. 2A</figref> to <b>2</b>C are tables showing data structures.

0019<figref idref="DRAWINGS">FIGS. 3A</figref> to <b>3</b>C are tables showing data structures.

0020<figref idref="DRAWINGS">FIGS. 4A and 4B</figref> are examples of a window for registering a group.

0021<figref idref="DRAWINGS">FIG. 5</figref> is an example of a window for configuring LUN masking and registering a switch.

0022<figref idref="DRAWINGS">FIGS. 6A</figref> to <b>6</b>C illustrate a communication sequence of the first embodiment.

0023<figref idref="DRAWINGS">FIG. 7</figref> is a flow chart illustrating the operation of an address table updating process.

0024<figref idref="DRAWINGS">FIG. 8</figref> is a flow chart illustrating the operation of a VLAN adding process.

0025<figref idref="DRAWINGS">FIG. 9</figref> is a flow chart illustrating the operation of a VLAN deleting process.

0026<figref idref="DRAWINGS">FIG. 10</figref> is a diagram showing an example of a system configuration according to a second embodiment.

0027<figref idref="DRAWINGS">FIG. 11</figref> is a diagram illustrating an example of a communication sequence of the second embodiment.

DESCRIPTION OF THE EMBODIMENTS

0028Embodiments of the invention will be described with reference to the accompanying drawings. In the drawings, similar devices are represented by identical reference numerals.

0029First, description will be made on a computer system according to a first embodiment of the invention. In the first embodiment, IP-SAN security is managed by a storage management device which manages the configuration of a storage device and monitors the storage device.

0030<figref idref="DRAWINGS">FIG. 1</figref> is a diagram showing an example of the system configuration of the first embodiment. A computer system has a storage management device <b>1</b>, a storage device <b>2</b>, switches <b>3</b> for switching packets, and hosts <b>4</b>, respectively interconnected by communication lines <b>20</b><i>a. </i>

0031The storage device <b>2</b> is constituted of a single storage device or a plurality of storage devices constituting a storage system. The storage device may be a non-volatile storage device such as a hard disk and a DVD. The storage system may adopt a RAID configuration. The storage device <b>2</b> has physical ports <b>41</b> for connection to the switch <b>3</b> or host <b>4</b> via the communication line <b>20</b><i>a. </i>

0032The host <b>4</b> is a general computer having an arithmetic unit, a memory, an input/output unit and the like. The host <b>4</b> has a physical port for connection to another device via the communication line <b>20</b><i>a. </i>

0033The switch <b>3</b> transfers data sent by the host <b>4</b> or storage device <b>2</b> to another device. The switch <b>3</b> has physical ports <b>42</b> for connection to the storage device <b>2</b> and physical ports <b>43</b> for connection to the host <b>4</b> or another switch <b>3</b>. Although the physical ports <b>42</b> and <b>43</b> are not required to be physically discriminated, they are discriminated herein for the purpose of description simplicities.

0034It is assumed that the storage management device <b>1</b>, storage device <b>2</b> and switches <b>3</b> are interconnected by communication lines <b>20</b><i>b </i>on which monitor and maintenance data flow. Instead of using the communication lines <b>20</b><i>b, </i>the monitor and maintenance data may be transferred via the communication lines <b>20</b><i>a. </i>In this embodiment, although the embodiment has two switches <b>3</b> and four hosts <b>4</b>, the numbers of switches and hosts are arbitrary.

0035The storage device <b>2</b> can become an iSCSI target. The storage device <b>2</b> has a controller which receives configuration information of LUN masking from an external to perform the configuration of LUN masking.

0036The switch <b>3</b> has a controller which receives configuration information of VLAN from an external to perform the configuration of VLAN. The controller of the switch <b>3</b> sends a forwarding database in response to a request from an external and notifies link-down to an external.

0037The storage management device <b>1</b> is a general computer. The storage management device <b>1</b> has: a central processing unit (hereinafter abbreviated to “CPU”) <b>24</b>, a secondary storage device <b>23</b> (hereinafter abbreviated to “magnetic disk”) such as a hard disk; a main storage memory (hereinafter abbreviated to “main memory”) <b>21</b>, communication lines <b>22</b> such as buses and crossbar switches; an output device <b>25</b> (hereinafter called “display”) such as a display device, a character input device <b>27</b> such as a keyboard; and a pointing device <b>26</b> such as a mouse. The storage management device <b>1</b> has also interfaces for connection to the communication lines <b>20</b><i>a </i>and <b>20</b><i>b. </i>

0038The main memory <b>21</b> stores various programs to be executed by CPU <b>24</b>. More specifically, the programs include: a GUI control program <b>10</b> to be executed by CPU <b>24</b> when a graphical user interface is supplied to a system administrator; a discovery request receiving program <b>11</b> to be executed when registration is received from an iSCSI target and when a discovery request of an iSCSI target from an iSCSI initiator (host) is received and responded; an ARP transmitting program <b>12</b> to be executed when the storage management device <b>1</b> performs translation between an IP address and a MAC address by using ARP (Address Resolution Protocol, RFC826); a port ID retrieving program <b>13</b> to be executed when a forwarding database is retrieved from the switch <b>3</b> and the MAC address is converted into a port ID which is an ID of a physical port; a LUN masking configuring program <b>14</b> to be executed when the LUN masking is configured for the storage device <b>2</b>; and a VLAN configuring program <b>15</b> to be executed when the VLAN configuration is performed for the switch <b>3</b>.

0039The forwarding database is a correspondence table showing the relation between a port ID of a physical port <b>42</b> (or <b>43</b>) of the switch <b>3</b> and a MAC address of a device connected to the physical port. An IP address is an identifier assigned to each device when the Internet protocol is incorporated as the protocol for the communication lines <b>20</b>. A MAC address is a specific identifier assigned to each device.

0040The iSCSI initiator is a device autonomously issuing an iSCSI command and corresponds to the host <b>4</b> in this embodiment. An iSCSI target is a device which is a communication partner of the iSCSI initiator, and corresponds to the storage device <b>2</b>, LU therein or the like in this embodiment.

0041The above-described programs are stored in the magnetic disk <b>23</b> in advance, by reading them from a portable recording medium or by downloading them from another computer via the network. These programs are loaded in the main memory <b>21</b> when it becomes necessary, and executed by CPU <b>24</b>. These programs may be implemented as dedicated hardware.

0042The magnetic disk <b>23</b> stores the following tables. An address table <b>30</b> stores the correspondence among an IP address and a MAC address corresponding to the physical port of the host <b>4</b> or storage device <b>2</b>, and a port ID of a physical port of the switch connected to the physical port of the host <b>4</b> or storage device <b>2</b>. A group table <b>31</b> stores an ID of a group constituted of an iSCSI initiator and an iSCSI target (these are collectively called “iSCSI node”) and a subnet address of VLAN to which the group belongs. A group membership table <b>32</b> stores an IP address of the iSCSI initiator constituting the group and an iSCSI name of the iSCSI target. A LUN masking table <b>33</b> stores an IP address of an iSCSI initiator accessible to the iSCSI target and each LU thereof. An iSCSI name table <b>34</b> stores a correspondence between the name of an iSCSI target and an IP address. A switch table <b>35</b> stores an IP address of a management physical port of each switch.

0043Each group is constituted of one or more iSCSI initiators such as a host <b>4</b> used by the same department or business which poses no problem of data tapping, and an iSCSI target used by the iSCSI initiators.

0044Brief description will first be made on the operation of the storage management device <b>1</b> of the first embodiment. First, a system administrator registers switches <b>3</b> installed in the computer system in the switch table <b>35</b>. Next, the system administrator registers groups in the group table <b>31</b>. Thereafter, when the storage device <b>2</b> is connected to the switch, the storage management device <b>1</b> judges the group to which the connected storage device <b>2</b> belongs, adds the storage device <b>2</b> to the group as a member, and instructs the switch <b>3</b> to add the storage device <b>2</b> to VLAN corresponding to the group.

0045Next, as the system administrator performs the configuration of LUN masking, the storage management device <b>1</b> instructs the storage device <b>2</b> to perform the configuration of LUN masking, judges the group of the host <b>4</b> designated by LUN masking, and adds the host to the group as a member. As the host <b>4</b> is connected to the switch <b>3</b> thereafter, the storage management device <b>1</b> instructs the switch <b>3</b> to add the host <b>4</b> to VLAN of the group to which the host <b>4</b> belongs.

0046Next, description will be made on the data structure of each table stored in the magnetic disk <b>23</b> of the storage management device <b>1</b>.

0047Each of the address table <b>30</b>, group table <b>31</b>, group membership table <b>32</b>, LUN masking table <b>33</b>, iSCSI name table <b>34</b> and switch table <b>35</b> has the array structure capable of registering one or more records.

0048<figref idref="DRAWINGS">FIG. 2A</figref> is a table showing an example of the data structure of the address table <b>30</b>. The address table <b>30</b> has one record per each physical port of the host <b>4</b> and storage device <b>2</b>. Each record has the following entries. An entry <b>300</b> registers an IP address assigned to the physical port corresponding to the record. An entry <b>301</b> registers a MAC address assigned to the physical port corresponding to the record. An entry <b>302</b> resisters a switch ID which is an identifier of the switch <b>3</b> connected to the physical port corresponding to the record. An entry <b>303</b> resisters a port ID of the physical port of the switch connected to the physical port corresponding to the record.

0049<figref idref="DRAWINGS">FIG. 2B</figref> is a table showing an example of the data structure of the group table <b>31</b>. The group table <b>31</b> has one record per each group. Each record of the group table <b>31</b> has the following entries. An entry <b>310</b> registers a group ID which is an identifier of the group corresponding to the record. An entry <b>311</b> registers a subnet address of VLAN to which the iSCSI initiator and iSCSI target constituting the group corresponding to the record belong. In this embodiment, since the group ID is also used as VLAN ID, it is assumed that the group ID takes an integer value from 1 to 4096.

0050<figref idref="DRAWINGS">FIG. 2C</figref> is a table showing an example of the data structure of the group membership table <b>32</b>. The group membership table <b>32</b> has one record per each iSCSI node. Each record has the following entries. An entry <b>320</b> resisters a group ID of a group belongs to which is the iSCSI node corresponding to the record. An entry <b>321</b> registers an IP address of the iSCSI node corresponding to the record. An entry <b>322</b> registers discrimination information indicating whether the iSCSI node corresponding to the record is an iSCSI initiator or an iSCSI target. An entry <b>323</b> registers information of a connection flag indicating whether or not the iSCSI node corresponding to the record is connected to the communication line <b>20</b><i>a. </i>

0051In this embodiment, it is assumed that the information registered in the entry <b>322</b> is either “initiator” or “target”. It is also assumed that the information registered in the entry <b>323</b> is “1” if the iSCSI node corresponding to the record is connected to the communication line <b>20</b><i>a, </i>and “0” if not.

0052<figref idref="DRAWINGS">FIG. 3A</figref> is a table showing an example of the data structure of the LUN masking table <b>33</b>. The LUN masking table <b>33</b> has one record per each iSCSI name given to the iSCSI target. Each record has the following entries. An entry <b>330</b> registers an iSCSI name corresponding to the record. An entry <b>331</b> registers LUN of LU contained in the iSCSI target designated by the iSCSI name corresponding to the record. A entry <b>332</b> registers an IP address of an iSCSI initiator accessible to LU registered in the entry <b>331</b>.

0053<figref idref="DRAWINGS">FIG. 3B</figref> is a table showing an example of the data structure of the iSCSI name table <b>34</b>. The iSCSI name table <b>34</b> has one record per each iSCSI name given to the iSCSI target. Each record has the following entries. An entry <b>340</b> registers an iSCSI name corresponding to the record. An entry <b>341</b> registers an IP address of the iSCSI target designated by the iSCSI name corresponding to the record. An entry <b>342</b> resisters a port number of the iSCSI target designated by the iSCSI name corresponding to the record.

0054<figref idref="DRAWINGS">FIG. 3C</figref> is a table showing an example of the data structure of the switch table <b>35</b>. The switch table <b>35</b> has one record per each switch <b>4</b> in the system. Each record has the following entries. An entry <b>350</b> registers a switch ID for identifying the switch <b>3</b> corresponding to the record. An entry <b>351</b> registers a management IP address assigned to a management physical port of the switch corresponding to the record.

0055Graphical user interfaces (hereinafter abbreviated to “GUI”) used by the embodiment will be described. These GUIs are displayed on the display <b>25</b> when the storage management device <b>1</b> executes the GUI control program <b>10</b>. A system administrator or the like sets each parameter on the displayed GUI by using the character input device <b>27</b> or pointing device <b>26</b>.

0056The display <b>25</b>, character input device <b>27</b> and pointing device <b>26</b> may be other devices different from those of the storage management device <b>1</b>. For example, a console terminal connected to the storage management device <b>1</b> via the communication line <b>20</b><i>b </i>or serial cable may have the display <b>25</b> and the like. In this case, the storage management device <b>1</b> executes the GUI control program <b>10</b>, and sends screen data to the console terminal which in turn displays GUI on the display <b>25</b>.

0057The console terminal sends each parameter set by a system administrator or the like via the character input device <b>27</b> or pointing device <b>26</b> to the storage management device <b>1</b>. The storage management device <b>1</b> may be provided with a command line interface having the equivalent function to that of GUI, instead of using GUI of this embodiment.

0058<figref idref="DRAWINGS">FIG. 4A</figref> is a diagram showing an example of an LUN masking configuration window <b>400</b> to be used for the configuration of LUN masking by a system administrator. The LUN masking configuration window <b>400</b> has: a button <b>401</b> for selecting an iSCSI name of an iSCSI target; an area <b>402</b> for displaying the iSCSI name selected by the button <b>401</b>; a button <b>403</b> for selecting an LUN in the iSCSI target; an area <b>404</b> for displaying the LUN selected by the button <b>403</b>; an area <b>405</b> for entering an IP address of an iSCSI initiator; a button <b>406</b> for registering information designated in these areas and by these buttons; and a button <b>407</b> for cancelling the registration.

0059Description will be given on the operation of the storage management device <b>1</b> to be performed when LUN masking is configured by a GUI operation. The following operation is performed by execution of the GUI operation program <b>10</b>.

0060When a system administrator or the like depresses the button <b>406</b> by using the pointing device or the like, the storage management device <b>1</b> adds a new record to the LUN masking table <b>33</b> in accordance with the contents displayed in the areas <b>402</b>, <b>404</b> and <b>405</b>.

0061Next, the storage management device <b>1</b> checks, for each record in the group table <b>31</b>, whether the IP address entered in the area <b>405</b> belongs to the subnet address registered in the entry <b>311</b>. If it belongs to the subnet, a record is added to the group membership table <b>32</b>. In this case, the group ID in the entry <b>310</b> of the record in the group table <b>31</b> is registered in the entry <b>320</b> of the record to be added, the contents in the area <b>405</b> are registered in the entry <b>321</b>, “initiator” is registered in the entry <b>322</b>, and “0” is registered in the entry <b>323</b>.

0062If the IP address entered in the area <b>405</b> belongs to the subnet of some record in the group table <b>31</b>, the storage management device <b>1</b> further checks whether the iSCSI target having the iSCSI name entered in the area <b>402</b> is registered in the group membership table <b>32</b>. If not registered, a record is added to the group membership table <b>32</b>. In this case, the group ID of the entry <b>310</b> of the record in the group table <b>31</b> is registered in the entry <b>320</b> of the record to be added, the contents in the area <b>401</b> are registered in the entry <b>321</b>, “target” is registered in the entry <b>322</b>, and “0” is registered in the entry <b>323</b>.

0063Lastly, the storage management device <b>1</b> executes the LUN masking configuring program <b>14</b>, and instructs the storage device <b>2</b> to configure LUN masking. Specifically, the storage management device <b>1</b> sends the information registered in the LUN masking table <b>33</b> to the storage device <b>2</b> so that the LUN masking is configured in accordance with the sent information. More specifically, the storage management device <b>1</b> sends an instruction to the controller of the storage device <b>2</b> so that an access is permitted from the host <b>4</b> designated by the designated IP address to the target having the designated iSCSI name.

0064<figref idref="DRAWINGS">FIG. 4B</figref> is a diagram showing an example of a group registration window <b>420</b> to be used for the registration of a group by a system administrator. The group registration window <b>420</b> has: an area <b>421</b> for entering a new group ID by a system administrator; an area <b>422</b> for entering a subnet address of VLAN to which the iSCSI nodes constituting the group belong; a button <b>423</b> for registering the information designated in these areas; and a button <b>424</b> for cancelling the registration.

0065Next, description will be made on the operation of the storage management device <b>1</b> to be performed when a group is registered by a GUI Operation. The operation is also performed by execution of the GUI control program <b>10</b>.

0066When a system administrator or the like depresses the button <b>423</b> of the group registration window <b>420</b> by using the pointing device or the like, the storage management device <b>1</b> adds a new record to the group table <b>31</b>. The contents in the area <b>421</b> are registered in the entry <b>310</b> of the record to be added, and the contents in the area <b>422</b> are registered in the entry <b>311</b>.

0067Next, the storage management device <b>1</b> selects a record having the IP address belonging to the subnet in the area <b>422</b> from the LUN masking table <b>33</b>. In accordance with the information in the selected record, the storage management device <b>1</b> adds a record of the iSCSI initiator and a record of the iSCSI target to the group membership table <b>32</b>. The contents in the area <b>421</b> are registered in the entry <b>320</b> of the record of the iSCSI initiator to be added, the IP address registered in the entry <b>332</b> is registered in the entry <b>321</b>, “initiator” is registered in the entry <b>322</b>, and “0” is registered in the entry <b>323</b>. The contents in the area <b>421</b> are registered in the entry <b>320</b> of the record of the iSCSI target to be added, the iSCSI name in the entry <b>330</b> is registered in the entry <b>321</b>, “target” is registered in the entry <b>322</b>, and “0” is registered in the entry <b>323</b>.

0068<figref idref="DRAWINGS">FIG. 5</figref> is a diagram showing an example of a switch registration window <b>440</b> to be used for the registration of a management port of each switch in the computer system by a system administrator or the like. The switch registration window <b>440</b> has: an area <b>441</b> for entering a switch ID; an area <b>442</b> for entering an IP address of a management port of the switch; a button <b>443</b> for registering the information designated in these areas; and a button <b>444</b> for cancelling the registration.

0069Next, description will be given on the operation of the storage management device <b>1</b> to be performed when a switch is registered by a GUI Operation by a system administrator.

0070When a system administrator or the like depresses the button <b>443</b> by using the pointing device or the like, the storage management device <b>1</b> adds a new record to the switch table <b>35</b> in accordance with the parameters designated by the buttons.

0071Next, a communication sequence among these devices of the embodiment will be described. The communication lines <b>20</b><i>a </i>for interconnecting the storage management device <b>1</b> and switch <b>3</b><i>a </i>are assumed to be configured so that the communication lines belong to a default VLAN having the VLAN ID of “0”. It is also assumed that VLAN trunks are configured to be connected to the physical ports of the switch <b>3</b><i>a </i>connected to another switch <b>3</b><i>b. </i>

0072<figref idref="DRAWINGS">FIG. 6A</figref> is a diagram illustrating a communication sequence to be performed when a physical port of the storage device <b>2</b> is connected to the switch <b>3</b> wherein the physical port <b>41</b> of the storage device <b>2</b> is connected to the physical port <b>42</b> of the switch <b>3</b><i>a. </i>

0073First, when the storage device <b>2</b> detects a link establishment, it registers an iSCSI target to a discovery service. The discovery service is a service of retrieving a list of iSCSI targets usable by an iSCSI initiator. IETF proposes that this service is implemented by using SLP (Service Location Protocol, RFC2608) or iSNS (Internet Simple Name Service).

0074In this embodiment, it is assumed that the storage management device <b>1</b> functions as a directory agent of SLP. The invention is also applicable to iSNS. If SLP is used, an iSCSI target is registered by sending a service advertisement packet. This service advertisement packet contains an iSCSI name, an IP address, a port number and the like, respectively of the iSCSI target. At this stage, the communication line <b>20</b><i>a </i>interconnecting the physical ports <b>41</b> and <b>42</b> belongs to the default VLAN (VLAN ID=“0”) (S<b>601</b>).

0075Upon reception of the service advertisement from the iSCSI target, the storage management device <b>1</b> adds a record to the iSCSI name table <b>34</b> in accordance with the contents of the service advertisement, and executes an address table updating process (from S<b>602</b> to S<b>605</b>).

0076The details of the address table updating process will be given. First, the storage management device <b>1</b> broadcasts an ARP request via the communication lines <b>20</b><i>a. </i>At this time, since the communication line <b>20</b><i>a </i>interconnecting the storage management device <b>1</b> and switch <b>3</b><i>a </i>and the communication line <b>20</b><i>a </i>interconnecting the physical ports <b>41</b> and <b>42</b> belong to the same VLAN, the broadcast packet reaches the physical port <b>41</b> (S<b>602</b>).

0077Upon reception of the broadcast packet, the storage device <b>2</b> sends an ARP response including a MAC address of the physical port <b>41</b> to the storage management device <b>1</b>. The storage management device <b>1</b> can therefore acquire the MAC address corresponding to the IP address of the iSCSI target (S<b>603</b>).

0078Next, the storage management device <b>1</b> acquires the forwarding database via the switch <b>3</b><i>a </i>and communication line <b>20</b><i>b </i>to obtain the port ID (port ID of the physical port <b>42</b>) corresponding to the MAC address.

0079Thereafter, the storage management device <b>1</b> stores the correspondence relation between the IP address and MAC address of the physical port <b>41</b> and the port ID of the physical port <b>42</b> connected to the physical port <b>41</b>, respectively acquired in the manner described above, in the address table <b>30</b> (S<b>604</b>, S<b>605</b>).

0080Lastly, the storage management device <b>1</b> executes a VLAN adding process. In this VLAN adding process, the storage management device <b>1</b> searches the group membership table <b>32</b> by using as a search key the iSCSI name of the iSCSI target contained in the service advertisement packet received at Step S<b>601</b>, to thereby acquire the group ID of the group to which the iSCSI target belongs. The storage management device <b>1</b> instructs via the communication lines <b>20</b><i>b </i>the switch <b>3</b><i>a </i>to configure VLAN in such a manner that the physical port <b>42</b> belongs to VLAN having the group ID as its VLAN ID (S<b>606</b>, S<b>607</b>).

0081<figref idref="DRAWINGS">FIG. 6B</figref> is a diagram illustrating a communication sequence to be performed when the host <b>4</b> is connected to the switch <b>3</b> wherein a host <b>4</b><i>a </i>is connected to the switch <b>3</b><i>a. </i>

0082In this communication sequence, first the host <b>4</b><i>a </i>sends a service request to the storage management device <b>1</b> to acquire a usable iSCSI target (S<b>611</b>) and lastly the storage management device <b>1</b> sends the usable iSCSI target to the host <b>4</b><i>a </i>via the communication line <b>20</b><i>a </i>(S<b>618</b>). The other communication sequence is similar to that shown in <figref idref="DRAWINGS">FIG. 6A</figref>. In the communication sequence to be performed when the host <b>4</b><i>c </i>or <b>4</b><i>d </i>is connected to the switch <b>3</b><i>b, </i>the switch <b>3</b><i>b </i>is inserted between the host <b>4</b> and switch <b>3</b><i>a, </i>and the other communication sequence is similar to that shown in <figref idref="DRAWINGS">FIG. 6A</figref>.

0083<figref idref="DRAWINGS">FIG. 6C</figref> is a diagram illustrating a communication sequence to be performed when the physical port of the storage device <b>2</b> or host <b>4</b> is disconnected from the switch wherein a host <b>4</b><i>a </i>is disconnected from the switch <b>3</b><i>a. </i>

0084The switch <b>3</b><i>a </i>detected disconnection of a link to the host <b>4</b><i>a </i>sends a link-down notice to the storage management device <b>1</b> via the communication line <b>20</b><i>b </i>by using a means such as SNMPTrap. It is assumed that the link-down notice contains the port ID of the physical port which was linked down (S<b>621</b>).

0085Upon reception of the link-down notice, the storage management device <b>1</b> derives information of the source IP address (IP address of the sender switch) and the port ID from the link-down notice. The storage device unit <b>1</b> searches the switch table <b>35</b> by using the source IP address as a search key to acquire the switch ID from the coincident record. The storage management device <b>1</b> further searches the address table <b>30</b> by using as a search key a combination of the acquired port ID and switch ID to save the IP address in the coincident record in an arbitrary area of the main memory <b>21</b> in order to use it in the VLAN deleting process, and thereafter deletes the record (S<b>622</b>).

0086Lastly, the storage management device <b>1</b> performs the VLAN deleting process. In the VLAN deleting process, the storage management device <b>1</b> sends a VLAN configuration request to the switch <b>3</b><i>a </i>via the communication line <b>20</b><i>b </i>in order to delete the physical port of the host <b>4</b> or storage device <b>2</b> whose link was disconnected (S<b>623</b>, S<b>624</b>).

0087Next, the details of the address updating process, VLAN adding process and VLAN deleting process described with reference to <figref idref="DRAWINGS">FIGS. 6A</figref> to <b>6</b>C will be described.

0088<figref idref="DRAWINGS">FIG. 7</figref> is a flow chart illustrating the operation of the address table retrieving process to be performed by the storage management device <b>1</b>.

0089Upon reception of the service advertisement packet or service request packet, the storage management device <b>1</b> executes the service request reception program <b>11</b> to acquire an IP address of a packet sender from the received service advertisement packet or service request packet (S<b>701</b>).

0090Next, the storage management device <b>1</b> executes the ARP sending program <b>12</b> to assemble an ARP request of inquiring the MAC address of the IP address obtained at S<b>701</b> and to broadcast it via the communication lines <b>20</b><i>a </i>(S<b>702</b>). Upon reception of the ARP response to the ARP request issued at S<b>702</b>, the storage management device <b>1</b> executes the ARP sending program <b>12</b> to derive the MAC address from the ARP response (S<b>703</b>).

0091Next, the storage management device <b>1</b> executes the port ID acquiring program <b>13</b> to fetch the first record of the switch table <b>35</b> (S<b>704</b>) and to send an acquisition request of the forwarding database to the management IP address of the record via the communication line <b>20</b><i>b. </i>For example, the acquisition request of the forwarding database can be realized by acquiring an ipNetToMediaTable of MIB-2 (Management Information Base-2, RFC1213) by using Get of SNMP (Simple Network Management Protocol) (S<b>705</b>).

0092Thereafter, the storage management device <b>1</b> searches the acquired forwarding database by using the MAC address acquired at S<b>703</b> as a search key (S<b>706</b>). If a corresponding entry is found (S<b>707</b>), the storage management device <b>1</b> adds a new record to the address table <b>30</b>, by entering the IP address acquired at S<b>701</b>, the MAC address acquired at S<b>703</b>, the switch ID of the record acquired at S<b>704</b> and the port ID of the entry acquired at S<b>707</b> (S<b>708</b>).

0093If a corresponding entry is not found at S<b>707</b>, the storage management device <b>1</b> repeats S<b>705</b> to S<b>707</b> for all records in the switch table <b>35</b> (S<b>709</b>, S<b>710</b>).

0094<figref idref="DRAWINGS">FIG. 8</figref> is a flow chart illustrating the operation of the VLAN adding process to be performed by the storage management device <b>1</b>.

0095First, the storage management device <b>1</b> executes the VLAN configuring program <b>15</b> to derive the ISCSI name of the iSCSI target or the IP address of the iSCSI initiator from the service advertisement packet or the service request packet respectively received at S<b>701</b> shown in <figref idref="DRAWINGS">FIG. 7</figref> (S<b>801</b>).

0096The storage management device <b>1</b> searches the group membership table <b>32</b> to obtain a group ID, by using as a search key the iSCSI name of the IP address respectively acquired at S<b>801</b> (S<b>802</b>).

0097Next, the storage management device <b>1</b> searches again the group membership table <b>32</b> by using the group ID acquired at S<b>802</b> as a search key (S<b>803</b>). If this search result indicates that the iSCSI target or the iSCSI initiator used as a key for searching the group ID is the first iSCSI node of the group, i.e., if the search at S<b>803</b> indicates that the values of the connection flags in the entries <b>323</b> of all records are “0” (S<b>804</b>), the storage management device <b>1</b> sends a VLAN configuring request of creating a VLAN having the group ID acquired at S<b>802</b> as its VLAN ID, to the switch via the communication line <b>20</b><i>b </i>(S<b>805</b>).

0098After the step at S<b>805</b> or if the value in the entry <b>323</b> of any record is “1” at S<b>804</b>, the storage management device <b>1</b> sends a VLAN adding request of adding the port ID acquired at S<b>707</b> shown in <figref idref="DRAWINGS">FIG. 7</figref> to the created (or already existing) VLAN via the communication line <b>20</b><i>b. </i>The destination of this VLAN configuring request or VLAN adding request is the management IP address <b>351</b> of the record acquired at S<b>704</b> or S<b>710</b> shown in <figref idref="DRAWINGS">FIG. 7</figref> (S<b>806</b>).

0099Thereafter, if necessary, the storage management device <b>1</b> may send a packet for storing or validating the switch configuration to the switch <b>3</b>. Lastly, the storage management device <b>1</b> changes the value in the entry of the record matching the search conditions at S<b>802</b> to “1” (S<b>807</b>).

0100<figref idref="DRAWINGS">FIG. 9</figref> is a flow chart illustrating the operation of the VLAN deleting process to be performed by the storage management device <b>1</b>.

0101First, the storage management device <b>1</b> executes the VLAN configuring program <b>15</b> to search the iSCSI name table <b>34</b> by using as a search key the IP address saved at S<b>622</b> of <figref idref="DRAWINGS">FIG. 6C</figref> (S<b>901</b>). If the search at S<b>901</b> finds a record (S<b>902</b>), the storage management device <b>1</b> judges that the iSCSI target was disconnected from the communication line <b>20</b>, derives the iSCSI name <b>340</b> from the record, and searches the group membership table <b>32</b> by using the iSCSI name as a search key (S<b>903</b>).

0102If the search at S<b>901</b> does not find a record (S<b>902</b>), the storage management device <b>1</b> judges that the iSCSI initiator was disconnected from the communication line <b>20</b>, and searches the group membership table <b>32</b> by using as a search key the IP address (S<b>904</b>).

0103If the search at S<b>903</b> or S<b>904</b> does not find a record (S<b>905</b>), the storage management device <b>1</b> terminates the process. If a record is found at S<b>905</b>, the storage management device <b>1</b> derives the group ID from the found record. The storage management device <b>1</b> sends a VLAN releasing request to the switch via the communication line <b>20</b><i>b, </i>the VLAN releasing request deleting the port ID contained in the link-down notice at S<b>621</b> shown in <figref idref="DRAWINGS">FIG. 6C</figref> from the VLAN having the derived group ID as its VLAN ID (S<b>906</b>).

0104The storage management device <b>1</b> changes the value in the entry <b>323</b> of the searched record at S<b>903</b> or S<b>904</b> to “0” (S<b>907</b>).

0105Next, the storage management device <b>1</b> searches again the group membership table <b>32</b> by using the group ID acquired at the preceding step as a search key (S<b>908</b>). If this search result indicates that the iSCSI target or iSCSI initiator is the last iSCSI node of the group, i.e., if the search at S<b>908</b> indicates that the values of the connection flags in the entries <b>323</b> of all records are “0” (S<b>909</b>), the storage management device <b>1</b> sends a VLAN deleting request of deleting VLAN corresponding to the group ID, to the switch via the communication line <b>20</b><i>b </i>(S<b>910</b>).

0106Thereafter, if necessary, the storage management device <b>1</b> may send a packet for storing or validating the switch configuration to the switch <b>3</b>. The destination of the VLAN releasing request at S<b>906</b> or the VLAN deleting request at S<b>910</b> is the management IP address <b>351</b> in the switch table <b>35</b> acquired at S<b>622</b> of <figref idref="DRAWINGS">FIG. 6C</figref>.

0107According to the first embodiment described above, a system administrator configures LUN masking and enters a subnet address of VLAN to which the host <b>4</b> and storage device <b>2</b> constituting a group belong. With only these works by the system administrator, the storage management device <b>1</b> automatically instructs a switch to create VLAN when the host <b>4</b> or storage device <b>2</b> is connected to the network. The work load for security countermeasure of IP-SAN by the system administrator can therefore be reduced considerably.

0108Next, a second embodiment will be described. Only different points from the first embodiment will be described. In the second embodiment, the above-described IP-SAN security management is performed by a switch <b>3</b>.

0109<figref idref="DRAWINGS">FIG. 10</figref> is a diagram showing the configuration of a computer system having a storage device <b>2</b>, switches <b>3</b><i>a </i>and <b>3</b><i>b </i>and hosts <b>4</b><i>a</i>, <b>4</b><i>b</i>, <b>4</b><i>c </i>and <b>4</b><i>d</i>, respectively connected by communication lines <b>20</b><i>a. </i>The storage device <b>2</b>, switches <b>3</b><i>a </i>and <b>3</b><i>b </i>are also interconnected by communication lines <b>20</b><i>b. </i>In the following, it is assumed that the switch <b>3</b><i>a </i>performs the IP-SAN security management.

0110The switch <b>3</b><i>a </i>has: data send/receive elements <b>50</b> for receiving data from a network and sending data to the network or a data switching element <b>51</b> which is a bus or crossbar switch for sending/receiving data to and from the two data send/receive elements data <b>50</b>; a forwarding database storage <b>52</b>; a data switching controller <b>53</b> for controlling a data transmission destination of the data send/receive element in accordance with the contents of the forwarding database storage <b>52</b>; a GUI controller <b>10</b>, a discovery request receiver <b>11</b>, an ARP sender <b>12</b>, a port ID retriever <b>13</b>, a LUN masking configuration element <b>14</b>; a VLAN configuration element <b>15</b> and a main memory <b>21</b>.

0111In this embodiment, although the switch <b>3</b><i>a </i>has two data send/receive elements <b>50</b>, it may have one, three or more data send/receive elements <b>50</b>. Also in this embodiment, although the GUI controller <b>10</b> and the like are realized by hardware, the functions of these may be realized by software programs stored in the main memory <b>21</b> similar to the first embodiment.

0112A management terminal enters configuration information to the switch via a management network.

0113The main memory stores an address table <b>30</b>, a group table <b>31</b>, a group membership table <b>32</b>, a LUN masking table <b>33</b>, an iSCSI name table <b>34</b> and a switch table <b>35</b>. A management IP address of a switch different from the switch <b>3</b><i>a </i>is registered in the switch table <b>35</b>.

0114<figref idref="DRAWINGS">FIG. 11</figref> is a diagram illustrating a communication sequence to be performed when a host <b>4</b><i>a </i>is connected to the switch <b>3</b><i>a. </i>

0115After the host <b>4</b><i>a </i>is connected to the switch <b>3</b><i>a, </i>the host <b>4</b><i>a </i>first sends a service request to the switch <b>3</b><i>a </i>(S<b>1101</b>). Upon reception of the service request, the switch <b>3</b><i>a </i>sends an ARP request to the host <b>4</b><i>a </i>by using the ARP sender <b>12</b> to acquire the MAC address of the host <b>4</b><i>a </i>(S<b>1102</b>, S<b>1103</b>).

0116Next, the switch <b>3</b><i>a </i>reads the contents of the forwarding database in the forwarding database storage <b>52</b> by using the data switching controller <b>53</b>. The port ID retriever <b>13</b> of the switch <b>3</b><i>a </i>searches the forwarding database by using the MAC address acquired at S<b>1103</b>. If an entry corresponding to the MAC address is found, the switch <b>3</b><i>a </i>judges that the host <b>4</b><i>a </i>is connected directly to the switch (without involvement of another switch), and acquires the port ID from the searched entry (S<b>1104</b>).

0117The VLAN configuration element <b>15</b> searches the group key table <b>31</b> by using as a key the IP address of the sender of the service request and acquires the group ID <b>310</b> of the searched record. The VLAN configuration element <b>15</b> requests the data switching element <b>53</b> to configure VLAN and add the port ID acquired at S<b>1104</b> to VLAN having the group ID as its VLAN ID. Thereafter, the data switching element <b>53</b> notifies the contents of the received VLAN configuration contents to the data send/receive element <b>50</b> so that the data send/receive element <b>50</b> can configure VLAN (S<b>1105</b>). Lastly, the discovery request receiver <b>11</b> of the switch <b>3</b><i>a </i>returns a service response to the host <b>4</b><i>a </i>(S<b>1106</b>).

0118If an entry cannot be found at S<b>1104</b>, the switch <b>3</b><i>a </i>performs a process similar to that of the first embodiment. For example, in the communication sequence to be performed when a host <b>4</b><i>c </i>is connected to the switch <b>3</b><i>b, </i>the sequence similar to that shown in <figref idref="DRAWINGS">FIG. 6B</figref> is performed by replacing the host <b>4</b><i>a </i>with the host <b>4</b><i>x, </i>the switch <b>3</b><i>a </i>with the switch <b>3</b><i>b, </i>and the storage management device <b>1</b> with the switch <b>3</b><i>a. </i>

0119Next, a third embodiment will be described. In this embodiment, the above-described IP-SAN security management is performed by the storage device <b>2</b>. In this embodiment, the storage device <b>2</b> has the main memory <b>21</b> and magnetic disk <b>23</b>. The main memory <b>21</b> stores the GUI controlling program <b>10</b>, discovery request receiving program <b>11</b>, ARP sending program <b>12</b>, port ID retrieving program <b>13</b>, LUN masking configuring program <b>14</b> and VLAN configuring program <b>15</b>. The magnetic disk <b>23</b> stores the address table <b>30</b>, group table <b>31</b>, group membership table <b>32</b>, LUN masking table <b>33</b>, iSCSI name table <b>34</b> and switch table <b>35</b>. The operation sequence of this embodiment is similar to that of the first embodiment, excepting that the storage management device <b>1</b> is replaced with the storage device <b>2</b>.

0120According to the present invention, LUN masking and VLAN configuration of IP-SAN can be controlled collectively so that a load of configuration works by a system administrator can be reduced and a miss occurrence rate can be lowered. The running cost of IP-SAN can therefore be lowered.

0121It should be further understood by those skilled in the art that although the foregoing description has been made on embodiments of the invention, the invention is not limited thereto and various changes and modifications may be made without departing from the spirit of the invention and the scope of the appended claims.