STORAGE SYSTEM CAPABLE OF AUTHENTICATING HOSTS ON A NETWORK
A network-based storage system comprises one or more block-level storage servers that connect to, and provide storage for, one or more host computers over logical network connections, such as TCP/IP connections. In one embodiment, the block-level storage servers implement a protocol through which a storage server authenticates a host before permitting the host to access storage resources. Upon successful authentication, the storage server may also provide access information to the host.
1 . A method of providing storage access over a computer network, comprising:
establishing a logical connection over a computer network between a host computer and a storage server;
performing an authentication sequence over the logical connection whereby the storage server authenticates the host computer;
when the authentication sequence fails, terminating the logical connection and denying the host computer access to storage resources of the storage server; and
when the authentication sequence is successful, providing access information over the logical connection from the storage server to the host computer to allow the host computer to access the storage resources, at least some of the access information being unique to the host computer.
2 . The method of claim 1 , wherein the logical connection is a TCP/IP connection.
3 . The method of claim 1 , wherein the authentication sequence comprises the storage server transmitting a randomized challenge to the host computer and thereafter determining whether a host response to the randomized challenge matches an expected response.
4 . The method of claim 1 , wherein the authentication sequence further comprises selecting a software version which is common to the storage server and the host computer, and selecting an authentication method which is dependent upon the selected software version.
5 . The method of claim 1 , wherein the access information specifies a set of dynamic ports to which the host computer may connect to perform input/output operations.
6 . The method of claim 1 , wherein the access information specifies a maximum number of logical connections that may be established by the host computer to the storage server.
7 . The method of claim 1 , wherein the access information specifies a number of storage partitions allocated to the host computer and sizes of such storage partitions.
8 . A network-based storage system, comprising:
a storage server comprising a processor, a network interface, and a plurality of storage devices, said storage server operative to communicate over a network with host computers, and to provide block-level storage services for the host computers;
said storage server operative to interact via said network with a host computer according to a method that comprises:
attempting to authenticate the host computer by performing an authentication sequence over a logical connection between the storage server and the host computer;
when the authentication sequence fails, terminating the logical connection and denying the host computer access to storage resources of the storage server; and
when the authentication sequence is successful, providing access information over the logical connection to the host computer to allow the host computer to access the storage resources, at least some of the access information being unique to the host computer.
9 . The network-based storage system of claim 8 , wherein the logical connection is a TCP/IP connection.