Patent Application
20060242689
1. Field of the Invention
The present invention generally relates to storage apparatuses and management modules therefor, and more particularly to a storage apparatus that is capable of virtually using storage parts of different kinds and/or with different performances (or functions) as storage parts of the same kind and/or with the same performance (or function), and to a management module therefor.
2. Description of the Related Art
The number of kinds of storage apparatuses have increased due to a large variety of information and a large amount of information to be stored in the storage apparatuses. Recently, a virtual storage apparatus, which uses a plurality of storage parts such as hard disk drives (HDDs) as if they were a single storage apparatus, has been reduced to practice so as to improve the management efficiency of the storage parts.
The conventional virtual storage apparatus combined the same kind of storage parts to provide an extremely large storage capacity. However, attempts have recently been started on combining different kinds of storage parts to virtually use the different kinds of storage parts as storage parts of a single kind. For example, a virtual storage apparatus combining a semiconductor memory and an HDD has been proposed, where a high-speed access can be made to a file that is stored in the semiconductor memory.
On the other hand, from the point of security, a mechanism by which the user assigns a password to the storage part is utilized, in order to prevent information leak that may be caused by unauthorized use of the storage part by a third party. For example, the password may be an HDD password. The HDD password is set in the HDD. Even when the HDD is connected to another personal computer (PC), access to the information in the HDD is not permitted unless the correct HDD password is input, and thus, the HDD password is an effective countermeasure against the information leak from the individual HDD.
However, in the virtual storage apparatus which combines a plurality of storage parts to virtually use the plurality of storage parts as a single storage apparatus, even if each of the individual storage parts is provided with an access control function such as the password, no function is provided to centrally manage the access control functions of the plurality of storage parts. For this reason, the access control function must be set for each of the individual storage parts. As a result, a security breach may be generated due to the complexity in managing the access control functions and an error that may be made when setting the access control functions.
For example, a Japanese Laid-Open Patent Application No. 8-30395 proposes a magnetic disk apparatus that efficiently utilizes a nonvolatile memory as a data storage region of a host unit, by making a modification to allocate an address space allocated to a magnetic disk to the nonvolatile memory. In addition, a Japanese Laid-Open Patent Application No. 9-297659 proposes a storage apparatus that integrates an HDD and a flash memory.
But when the different kinds of storage parts and/or the storage parts having the different performances (or functions) are simply combined in the virtual storage apparatus, it is impossible to effectively bring out the characteristics of each of the storage parts, and there was a problem in that the performance of the virtual storage apparatus does not improve considerably contrary to expectations.
In addition, with regard to the security, even if each of the individual storage parts is provided with the access control function such as the password, no function is provided to centrally manage the access control functions of the plurality of storage parts. For this reason, the access control function must be set for each of the individual storage parts. As a result, there was a problem in that a security breach may be generated due to the complexity in managing the access control functions and an error that may be made when setting the access control functions or, by assembling in the virtual storage apparatus the individual storage parts that are not provided with the access control functions.
Accordingly, it is a general object of the present invention to provide a novel and useful storage apparatus and management module therefor, in which the problems described above are suppressed.
Another and more specific object of the present invention is to provide a storage apparatus and a management module therefor, that can effectively bring out the characteristics of individual storage parts and/or ensure security even when using storage parts of different kinds and/or with different performances (or functions).
Still another object of the present invention is to provide a management module for a storage apparatus, comprising a device attribute managing part configured to manage attribute information of at least two storage parts of different kinds and/or with different performances that are virtually used as a single virtual storage apparatus, and to provide at least a portion of the attribute information with respect to a host unit, where the attribute information includes storage region information indicating a storage region occupied by each storage part in the virtual storage apparatus, and performance information of each storage part, in correspondence with each other. According to the management module of the present invention, it is possible to effectively bring out the characteristics of individual storage parts.
A further object of the present invention is to provide a management module for a storage apparatus, comprising a security control part configured to centrally manage each of at least two storage parts that are virtually used as a single virtual storage apparatus, by carrying out a setting and/or a control related to security of each of the storage parts, where the security control part is connectable to the storage parts. According to the management module according to the present invention, it is possible to ensure security even when using storage parts of different kinds and/or with different performances (or functions).
Another object of the present invention is to provide a storage apparatus comprising at least two storage parts of different kinds and/or with different performances that are virtually used as a single virtual storage apparatus; and a device attribute managing part configured to manage attribute information of each of the storage parts, and to provide at least a portion of the attribute information with respect to a host unit, where the attribute information includes storage region information indicating a storage region occupied by each storage part in the virtual storage apparatus, and performance information of each storage part, in correspondence with each other. According to the storage apparatus of the present invention, it is possible to effectively bring out the characteristics of individual storage parts.
Still another object of the present invention is to provide a storage apparatus comprising at least two storage parts that are virtually used as a single virtual storage apparatus; and a security control part configured to centrally manage each of the storage parts, by carrying out a setting and/or a control related to security of each of the storage parts. According to the storage apparatus of the present invention, it is possible to ensure security even when using storage parts of different kinds and/or with different performances (or functions).
Other objects and further features of the present invention will be apparent from the following detailed description when read in conjunction with the accompanying drawings.
In the present invention, a device attribute managing part is provided to utilize the characteristics of each of individual storage parts to an upper limit. The device attribute managing part has a function of managing attribute information of each of the individual storage parts that is under control of a virtual storage apparatus and provides the attribute information to a host unit. Hence, it is possible to bring out the characteristics of the storage parts forming the virtual storage apparatus, and to allocate information (or files) that are frequently used in a computer system to the high-speed storage parts, so that the performance is improved such as quick booting of an operating system (OS).
In addition, by providing a security control part for centrally managing each of the individual storage parts that is under the control of the virtual storage apparatus, it is possible to simplify the management of the security control and suppress the generation of security breaches.
A description will be given of embodiments of a storage apparatus according to the present invention and a management module therefor according to the present invention, by referring to the drawings.
As shown in
In
It is assumed for the sake of convenience that the storage part 12 is formed by a semiconductor memory device (hereinafter simply referred to as a memory), and the storage part 13 is formed by an HDD. A description will be given of the information that is managed by the device attribute managing part 11 for this case. In other words, the storage part 12 and 13 are different kinds of storage parts and have different performances (or functions) such as the read/write speeds and the storage capacities. The following Table 1 shows contents of an attribute management list that is stored in the memory within the device attribute managing part 11. The attribute management list includes a device attribute that indicates the existence of the read/write function, performance information including the read/write speed and the total number of blocks, and address range (or storage region) information indicating the address range (or storage region) occupied by each of the storage parts 12 and 13 within the virtual storage apparatus 1.
From the attribute management list of the Table 1, it may be seen that the memory 12 which enables the high-speed read/write is used for the block addresses (BAs) 0 to 99 of the virtual storage apparatus 1, and the HDD 13 is used for the block addresses of 100 to 399. The device attribute managing part 11 can provide attribute information shown in the following Table 2 from the attribute management list of Table 1. As may be seen from the Table 2, the attribute information includes the address range (or storage region) information indicating the address range (or storage region) occupied by each of the storage parts 12 and 13 within the virtual storage apparatus 1, and performance information (read/write and read/write speed) of each of the storage parts 12 and 13, in correspondence with each other.
From the attribute information shown in the Table 2, the host unit 2 can recognize that the read/write of the file can be carried out at the high speed for the block addresses 0 to 99. Hence, it is possible to arrange the files that are frequently accessed, with a priority over other less frequently accessed files, in the area having the block addresses 0 to 99, for example. As a result, it is possible to effectively utilize the characteristics of the individual storage parts 12 and 13 forming the virtual storage apparatus 1.
Next, a description will be given of a method of acquiring a read/write speed of a storage part that is replaced or added, when replacing or adding the storage part.
The virtual storage apparatus 1 confirms, immediately after the power is turned ON, whether or not the apparatus structure has been modified from the last time when the virtual storage apparatus 1 was used (that is, the previous use). If a modification of the apparatus structure from the previous use is detected, the virtual storage apparatus 1 reacquires the attribute information of each storage part, and forms the attribute management list again. In this case, it is assumed for the sake of convenience that a correspondence table of the write speed and the apparatus type (hereinafter referred to as a device type) of each storage part is prestored in the memory within the device attribute managing part 11, and that the write speed is determined with respect to the device type acquired from each storage part. The following Table 3 shows an example of the contents of the correspondence table.
The device type may be acquired by issuing a SCSI inquiry command, for example.
As another method of judging the write speed, it is possible to employ a method of carrying out a test write with respect to the device. In this case, a predetermined amount of data, such as several blocks or 1 MB, are written in the device, and the write speed is actually measured.
The measuring process shown in
Next, a description will be given of a method of creating the attribute management list when replacing or adding the storage part, in a case where the storage capacity of the storage part that is replaced or added is different from that of the storage part existing before the replacement or addition. It is assumed for the sake of convenience that the storage parts 12 and 13 have a structure (that is, an address map) shown in
Suppose that the memory 12 that is originally connected in the virtual storage apparatus 1 is to be replaced by a new memory 12-1 having a size (memory capacity) larger than that of the memory 12.
If the address ranges in the attribute management list are combined for each storage part, the addresses of the HDD 13 that is not replaced will also be changed, as shown the following Table 5. More particularly, the block addresses 100 to 399 before the replacement are changed to the block addresses 150 to 449 after the replacement. In this case, when the data stored in the HDD 13 before the replacement are to be utilized, an inconvenience is introduced in that the access cannot be made to the data because the addresses will have been changed.
Therefore, in order to eliminate the inconvenience described above, this embodiment creates the attribute management list as shown in the following Table 6. In other words, the address range of the new memory 12-1 that replaced the memory 12 is registered in divisions (or segments), namely, as a size identical to that before the replacement and a remaining size. As a result, the addresses of the HDD 13 will not be changed, and the data stored in the HDD 13 before the replacement can be utilized. As may be seen from the Table 6, the apparatus IDs of the storage parts 12-1 and 13 are also registered in the attribute management list, thereby making it possible to indicate that the memory 12-1 is registered in divisions. This is useful in that, when removing the memory 12-1, for example, it is possible to know the particular addresses (in this case, the addresses 0 to 99 and 400 to 499) that will be effected by the removal.
Next, suppose that the memory 12 that is originally connected in the virtual storage apparatus 1 is to be replaced by a new memory 12-2 having a size (memory capacity) smaller than that of the memory 12.
In this case, if the address ranges of the attribute management list were combined for each storage part, the addresses of the HDD 13 that is not replaced would also be changed as shown in the following Table 7. More particularly, the addresses 100 to 399 before the replacement will be changed to the addresses 50 to 349 after the replacement. In this case, when the data stored in the HDD 13 before the replacement are to be utilized, an inconvenience is introduced in that the access cannot be made to the data because the addresses will have been changed.
Therefore, in order to eliminate the inconvenience described above, this embodiment creates the attribute management list as shown in the following Table 8. In other words, the insufficient address range (or insufficient memory capacity) of the new memory 12-2 that replaced the memory 12 is registered as a reserved area, so as to avoid a change in the addresses of the HDD 13. Consequently, the data stored in the HDD 13 before the replacement can be utilized after the replacement.
According to this first embodiment of the storage apparatus, it is possible to effectively bring out the characteristics, such as the read-write speed, of each of the individual storage parts.
In
As shown in
In a first embodiment of a password registration, an HDD password registration command is issued from the host unit 2 with respect to the virtual storage apparatus 101. The HDD password is “1111”, for example. The security control part 111 within the virtual storage apparatus 101 issues a password registration command separately with respect to the storage part (HDD) 112 and the storage part (HDD) 113 that are under the control of the security control part 111.
In a second embodiment of the password registration, an HDD password registration command is issued from the host unit 2 with respect to the virtual storage apparatus 101. The HDD password is “1111”, for example. The security control part 111 within the virtual storage apparatus 101 issues a password registration command separately with respect to the HDD 112 and the HDD 113 that are under the control of the security control part 111. In this state, the security control part 111 subjects the HDD password received from the host unit 2 to a predetermined operation, so as to generate different HDD passwords for use with the HDDs 112 and 113. Hence, even if the password from the host unit 2 is stolen by an unauthorized third person, an access cannot be made to all of the HDDs 112 and 113 by use of the stolen HDD password, because the passwords are different for each of the HDDs 112 and 113, and the security is improved. When carrying out the predetermined operation, it is possible to use information peculiar to each individual HDD, so as to generate a unique password each time for each of the individual HDDs.
In a third embodiment of the password registration, consideration is given to a case where at least one of the storage parts forming the virtual storage apparatus 101 does not have the password function, when setting the password from the host unit 2 to the virtual storage apparatus 101. In such a case, when the password registration process is carried out without recognizing that a storage part not having the password function exists in the virtual storage apparatus 101, the access control cannot be made with respect to this storage part within the virtual storage apparatus 101, and the information leak may be generated if this storage part is stolen, for example. Hence, when carrying out the password registration process, this embodiment provides in the security control part 111 a function of confirming whether or not a predetermined password function is supported by each of the storage parts within the virtual storage apparatus 101. When this function provided in the security control part 111 detects a storage part that does not support the predetermined password function, the password registration process is discontinued and an error notification is made with respect to the host unit 2.
On the other hand, if the decision result in the step S33 is YES, a step S35 generates HDD passwords “2222” and “3333” for the individual HDDs 112 and 113, respectively, based on the HDD password “1111”. A step S36 issues a registration command for the HDD password “2222” with respect to the HDD 112. In addition, a step S37 issues a registration command for the HDD password “3333” with respect to the HDD 113, and the process ends.
The matching (or collating) of the passwords can be realized by sending the HDD password received from the host unit 2 to each of the HDDs 112 and 113 from the security control part 111, similarly as in the case at the time of the password registration. In the first embodiment of the password registration described above, when the HDD password “1111” is received from the host unit 2, the security control part 111 sends the HDD password “1111” to each of the HDDs 112 and 113 that are under the control of the security control part 111.
In the second embodiment of the password registration described above, the security control part 111 carries out the predetermined operation with respect to the HDD password “1111” received from the host unit 2, and generates the HDD passwords “2222” and “3333” that are sent to the corresponding HDDs 112 and 113.
After sending the password, the security control part 111 attempts an access to both the HDDs 112 and 113, so as to confirm whether or not an access lock is released in a normal manner.
In a case where an illegitimate HDD password is sent from the host unit 2, an HDD password mismatch occurs in one or both of the HDDs 112 and 113 as a result of sending this illegitimate HDD password to the HDDs 112 and 113. In this case, it is possible to detect a release failure when confirming the release of the access lock, and the security control part 111 makes an error end (or abnormal end) with respect to a sector access type (read/write) command that is issued from the host unit 2.
A step S45 confirms the lock release of each of the HDDs 112 and 113, by carrying out a sector read. A step S46 decides whether or not the lock release is made in each of the HDDs 112 and 113. If the decision result in the step S46 is NO, a step S47 prohibits (that is, does not permit) the access from the host unit 2 to the virtual storage apparatus 101, and the process ends. On the other hand, if the decision result in the step S46 is YES, a step S48 permits the access from the host unit 2 to the virtual storage apparatus 101, and the process ends.
Accordingly, if an erroneous password is sent from the host unit 2, the security control part 111 cannot send legitimate (or correct) passwords with respect to the HDDs 112 and 113, and for this reason, the access lock of the HDDs 112 and 113 will not be released. Hence, the security control part 111 returns an error notification with respect to the sector access type command from the host unit 2, so as not to permit the access from the host unit 2 to the virtual storage apparatus 101.
According to this second embodiment of the storage apparatus, it is possible to ensure security even when using storage parts of different kinds and/or with different performances (or functions).
As a third embodiment of the storage apparatus according to the present invention, it is possible to combine the first and second embodiments of the storage apparatus described above. In this case, the virtual storage apparatus includes, in addition to the plurality of storage parts, both the device attribute managing part 11 shown in
According to this third embodiment of the storage apparatus according to the present invention, it is possible to effectively bring out the characteristics of such as the read/write speed of the individual storage parts, and simultaneously ensure security even when the storage parts of different kinds and/or with different performances (or functions) are used.
When a plurality of storage parts are connected to the virtual storage apparatus, it is possible to provide two modes that are selectable, so that all of the storage parts are virtually used as a single storage apparatus as in the case of the first and third embodiments in one mode, and the storage parts are grouped depending on the kinds and/or the performances of the storage parts as in the case of the conventional storage apparatus and each group is used as a separate storage apparatus in another mode.
In each of the embodiments of the storage apparatus described above, the HDDs and/or the semiconductor memory devices (memories) are used as the storage parts, but the storage parts are not limited to such devices. For example, an optical recording medium drive such as an optical disk drive or, a magneto-optical recording medium drive such as a magneto-optical disk drive, may be used in place of the HDD. Moreover, the semiconductor memory device is not limited to a particular type of memory, and various kinds of nonvolatile memories may be used.
This application claims the benefit of a Japanese Patent Application No. 2005-122665 filed Apr. 20, 2005, in the Japanese Patent Office, the disclosure of which is hereby incorporated by reference.
Further, the present invention is not limited to these embodiments, but various variations and modifications may be made without departing from the scope of the present invention.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2005-122665 | Apr 2005 | JP | national |
