Controlled discovery of SAN-attached SCSI devices and access control via login authentication
View Patent ↗A method for accessing data in a storage area network is provided. The method initiates with receiving a request for a list of targets on the storage area network. All the targets on the storage area network are exposed to the requestor and authentication requiring a password is requested from the requestor to grant access to the targets on the storage are network. Access to the targets is granted if the password is acceptable, and access to the targets is refused if the password is unacceptable.
1. A system comprising:
a target device; and
a storage appliance coupled to the target device, the storage appliance including:
a network interface for receiving a request from one of a plurality of client devices to access the target device;
a storage interface for accessing data from the target device; and
a datapath for implementing a storage transfer protocol to facilitate transfer of data between the client device and the target device, wherein the storage appliance is defined to determine which of the client devices has access to the target device based on a password, wherein to determine which of the client devices has access to the target device, the storage appliance is configured to determine whether the request includes a name of the target device and is defined to authenticate the password within the request without determining an identity of the one of the client devices, wherein the storage appliance is further defined to allow access to the target device upon determining that the request includes the name of the target device and that the password has been authenticated and without determining the identity of the one of the client devices.
2. The system of claim 1 , wherein the target device includes a logic device, wherein the network interface is a medium for presenting the logical device to a storage area network.
3. The system of claim 1 , wherein the request is generated from an iSCSI initiator code.
4. The system of claim 1 , wherein the request is received after another request for a list of target devices on a storage area network is received.
5. The system of claim 1 , wherein the target device includes a storage device, wherein the storage device is virtual or physical.
6. The system of claim 1 , wherein the one of the client devices comprises a work station or a host device.
7. The system of claim 1 , wherein the storage interface is configured to send the request to the data path for application of the storage transfer protocol.
8. The system of claim 1 , wherein the storage transfer protocol comprises Ethernet, IP, TCP, iSCSI, FC layers 1-4, or ULP.
9. The system of claim 1 , wherein the data path is configured to apply a target application layer protocol, wherein the target application layer protocol is defined in SCSI application layer specifications.
10. The system of claim 1 , wherein the name includes an iSCSI qualified name (IQN) name.
11. The system of claim 1 , wherein the password is a part of a challenge handshake authentication protocol (CHAP).
12. The system of claim 1 , wherein the storage appliance is further defined to deny access to the target device upon determining that the password has not been authenticated.
13. The system of claim 1 , wherein the storage appliance is configured to allow access to the target device without utilizing mapping techniques that use the identity of the one of the client devices.
14. The system of claim 1 , wherein the password is uniquely indexed by the name of the target device.
15. The system of claim 1 , wherein the target device comprises a storage device, wherein the storage device includes a disc or a RAID array device.
16. The system of claim 1 , wherein the identity of the one of the client devices comprises an iSCSI qualified name (IQN) name of the one of the client devices.
17. A method comprising:
receiving a request from one of a plurality of client devices to access a target node;
determining which of the client devices has access to the target node based on a password, wherein said determining which of the client devices has access to the target node includes determining whether the request includes a name of the target node and whether the password of the request has been authenticated without determining an identity of the one of the client devices; and
allowing access to the target node upon determining that the request includes the name of the target node and that the password has been authenticated and without determining the identity of the one of the client devices.
18. The method of claim 17 , further comprising denying access to the target node upon determining that the password has not been authenticated.
19. The method of claim 17 , wherein allowing the access to the target node is performed without utilizing mapping techniques that use the identity of the one of the client devices.
20. A non-transitory computer-readable storage medium with an executable program stored thereon, wherein the program instructs a computer to perform the following operations:
receiving a request from one of a plurality of client devices to access a target node;
determining which of the client devices has access to the target node based on a password, wherein said determining which of the client devices has access to the target node includes determining whether the request includes a name of the target node and whether the password of the request has been authenticated without determining an identity of the one of the client devices; and
allowing access to the target node upon determining that the request includes the name of the target node and that the password has been authenticated and without determining the identity of the one of the client devices.