System and method for intrusion protection of network storage

1. A method for protecting data stored in a storage system, comprising:

assigning at least one logical volume of the storage system to a host computer;

whenever the host computer initiates a procedure to go off line, sending from the host computer instruction to the storage system to lock the assigned logical volume;

during a time when the host computer remains off line performing:

locking the assigned logical volume by refusing any write request to the assigned volume; and,

storing in the storage system pre-defined access information; and,

when the host resumes operation on line, sending the access information to the host.

2. The method of claim 1 , further comprising the step:

calculating a host hash value for selected data of the assigned logical volume, and storing the host hash value locally on the host computer.

3. The method of claim 2 , wherein the logical volume comprises system information data and user data, and wherein the selected data comprises user data.

4. The method of claim 3 , wherein upon receiving an indication that the host resumes operation, the storage system sends a storage hash value to the host, and the host compares the storage hash value to the host hash value to detect security breach.

5. The method of claim 1 , wherein the access information comprises last access time and last access host ID.

6. The method of claim 5 , wherein step b further comprises storing in the host a host last access time and a host last access host ID.

7. The method of claim 6 , further comprising upon resuming operation by the host, comparing the last access time to the host last access time, and the last access host ID to the host last access host ID to detect security violation.

8. The method of claim 7 , wherein upon detecting a security violation, the host computer execute a virus check.

9. The method of claim 1 , wherein OS of the host computer resides in the storage system, and wherein step d further comprises:

determining the integrity of the stored OS;

If integrity check is safe, booting the host computer from the stored OS.

10. The method of claim 1 , wherein upon receiving a write command to a target volume from a host computer, performing the steps:

determining whether the target volume is guarded and, if so, returning an error message; otherwise:

executing the write command and determining whether the target volume is a user data area and, if so, calculating a hash value of the target volume and updating the pre-defined access information.

11. A system enabling protection of data stored in a storage system, comprising:

A host computer coupled to the storage system, the host computer comprising:

a processor;

host memory;

local volume; and

a host security module, the security module comprising a volume protection module operable to transmit volume lock instructions to lock a storage assigned volume prior to disconnecting the host computer from the storage system; and,

a storage system having logical units defined therein, at least one of the logical units comprising the storage assigned volume, the storage system comprising:

a storage network area interface;

a controller;

a memory unit;

a plurality of physical storage devices; and

a storage security module, the security module comprising:

a volume locking module operable to lock the storage assigned volume upon receiving the volume lock instructions from the host security module; and

access history handling module operable to store in the memory unit pre-defined access information;

wherein the host computer further comprises volume integrity information table and the storage system further comprises access history information table; and

wherein the volume integrity information table comprises entry fields for:

logical unit number;

last access host ID for host;

last access host ID for storage;

last access time for host;

last access time for storage;

last hash value for host; and

last hash value for storage.

12. The system of claim 11 , wherein prior to disconnecting from the storage system, the host computer refreshes the values stored in fields: last access host ID for host; last access time for host; and last hash value for host.

13. The system of claim 11 , wherein upon resuming connection to the storage system, the host computer obtain values from the storage system for the fields: last access host ID for storage; last access time for storage; and last hash value for storage.

14. The system of claim 11 , wherein the storage system further comprises access history information table comprising entries for:

logical unit number;

hash value;

access host ID; and

access time.